[philiprakusen]

Does anyone know how to create a ‘who is online NOW’ script? Just like the one on this website --------->

I can track users logging in by inserting the date into a table, but I have no way of knowing when they log out – although there is a Log Out button, obviously I cannot force users to click it instead of going elsewhere or closing the window.

We are not using any web stats program, but I’m convinced it can be done with a ColdFusion Function, Tokens, Sessions, or Cookies, etc.

Any ideas or advice?

[skyhawk133]

You create a column for last_activity and each page the user goes to should update that column with a current time stamp...

Pull all users with a timestamp in the past 60 minutes...

Then put code in the same page that records the last_activity to also check for sessions that are older than say... 24 hours and delete those sessions from the database.

That's how our system works... or there about.

[philiprakusen]

skyhawk133, on Jan 20 2005, 09:04 AM, said:

You create a column for last_activity and each page the user goes to should update that column with a current time stamp...

Pull all users with a timestamp in the past 60 minutes...

Then put code in the same page that records the last_activity to also check for sessions that are older than say... 24 hours and delete those sessions from the database.

That's how our system works... or there about.

Bingo! Cheers for the help.

I guess deep down, I'm just after something absolutely accurate.

[skyhawk133]

Well, you can't get more accurate than the way I've done ours... showing how long since their last click gives you a good idea of if they are really still active or not.

[philiprakusen]

skyhawk133, on Jan 20 2005, 09:28 AM, said:

Well, you can't get more accurate than the way I've done ours... showing how long since their last click gives you a good idea of if they are really still active or not.

Quite right - thanks again.

[manaya]

Hi everybody. I've tried to follow this process using coldFusion but I couldn't success after so many days and cups of coffee that's why I come here reaching your wisdom, please help me:
- The main page index.cfm shows the same content even if the user is authenticated or not (some contents from databases into tables -not important by now-).
- There is a login section also in the index page, so if users want to perform some activities exclusive for registered users they can authenticate through it.
- If authentication fails, the index.cfm page is displayed again with the only difference of having a "invalid username/password try again" in the login section.
- If the authentication succeed the index.cfm would show again and say in the login section "welcome username!" and a buttom which says "logout".
- the index page is showing all the content, so it reloads and reloads itself showing different content from database according to the parameters passed through URL.

The problems/questions I have are:

-can I store some user defined values in the session object like "session username and session user id"? n this case how can I retrieve them if I reload the same page over and over again? should I change my system schema?
-While authenticating I don't know how to keep the session variables since if I ask in the begining of the document: "if is defined session username then do this" it presents me "session object is not defined" of course, because Is defined below if user authentication succeed. Seems like the session variables are lost and I can not make them stay in server instead of get lost with application reload.
- I need to retrieve all the usersname stored in the session object for all the users online, for example, if there is 3 users= john, lucas, manuel I can write in the page = "registered users online 3: john, lucas, manuel - not registered: 120"

I'd appreciate any help, and thanks in advance.

M.-

[manaya]

Hi everybody, I think I'm finally getting around the problem. My progress is like this:
1)Created an application.cfm that
- declares an application with session management, client management, cookies and declare expiration dates.
- creates a parameter for this application which is "session.LoggedIn" with "false" as default value.
- redirects everybody whose tries to perform an action without been logged in to the index.cfm with the login

option.
- If there is a "logout" request, then executes: StructClear(Session)
- enable cookies and insert id and token values (I haven't use this values yet)
2) in the index.cfm the structure is like follows:
if cgi method is post
| if user has not initiated session and login request is defined {
| | execute login query
| | if recordcount is 0{ redirect to index with fail login message}
| | else {create session, assign some values to session, write cookies, and redirect to logged in page}
| | end if
| else (user already initiated session) {open index.cfm with logged in active}
| end if
| if request is logout {clear session, redirect to index with login page active }
else {open index with login page active}
end if

Ok this works, but still not optimum. I'll follow the idea of declare a structure which stores every user name and

then show in the login page (by now I'm solving this by using a "insert into track table username, userid and time

of transaction". then verify time of last transaction of users and if time is more than 30 min or they request to

logout then delete them from table- of course it requires that for every refresh of page, every request I need to

update time of user with now() value).

So, my new questions/problems I have are:
- should I use the cookies values (id and token, also username a and userid are defined there) to check in case some

user closes his browser and open new one of the site with his session time still active to keep him connected as if

he never has closed the browser?, in this case how can I do?
- in case of replace the database for structures in server memory, how is the best way to get around it?
- In case a user closes his browser window, can I end his session?
- please I receive with joy any comments of advices or links or code about users authentication and security.

Thanks in advance, hope to hear about you soon.

M.-

[manaya]

Nobody answers in this forum?, is there another way more effective of communication in here?.
thanks again.
M.-

[snoj]

Not many users here use ColdFusion methinks...I don't.

[Amadeus]

supersloth and shyhawk use ColdFusion a great deal...I belive it's the main language they work with.

[manaya]

Hi Again.
Thanks anyway for your time. If still somebody knows security related issues in coldfusion it would be great.
M.-

[skyhawk133]

I'll try to take a look today for you, been really busy.

[skyhawk133]

I'm not real sure I understood your entire post, but I think what you're having problems with is storing all the sessions so you can see who is online, when a user logs in you need to write their session ID and username to a database...

Can you explain exactly what problem you're having and we'll go from there.

[manaya]

Hi there, thanks for replying.

Well starting from this point of showing current active users without store them in data base could be a great plan.

I'm wondering if is possible to declare a structure that holds the session.usernames everytime somebody login. This should be a thread process on server I think.

In case there is no way of store sessions in a structure, but working with a database I have some questions:
- how can I log them off when they close the window?. Like -script: on windows close [ cfcode execute query of del user from table ]-

-If want to log them off automaticaly every 20 min of inactivity for example, user x with id 3 performs an action on time 00:04 and then he reloads on 00:06 (counter was 2min, but user reloaded and the counter is reset on this time) but on 00:26 the counter is finished-20 min- then I delete this user from active users.

- Updating the time stamp on database everytime users perform an action is efficient?, if I want to do something like update the time stamp on a cookie ?, I need some orientation here...

Thanks in advance for your help.

M.-

[skyhawk133]

The application scope stores variables on the server itself, you can create an array within the application scope (application.usersonline) and append to the array/structure each time a user logs in, this will basically allow you access the information about the user from a centralized variable that is stored server side without a database, but it will not take care of the log out issue. You could also store a time stamp with the username and on every page check if any elements in the structure are past the time stamp (60 minutes?!) and if they are remove them.

Hope that helps... you can still keep the user session active using the session scope, but the application scope should help you achieve your desired result.