I have a JS ajax function that calls an ASP page every minute to check
whether a record is free for editing. It is on a PW protected site with a 1
hour timeout. For some reason, when the browser is left open & unused, the
session is not timing out. I'm presuming the ajax call refreshes the
session..

The problem is, if a browser is left open on a public machine, other people
can use the session under the original users credentials. Is there a way
round this? Like preventing the call from refreshing the session? Or will I
need to stick messy JS timers and such like into the web page?

Thanks for you help
Giles

"Giles" <giles [at] nospam.com> wrote in message
news:exUIZE%234GHA.4616 [at] TK2MSFTNGP05.phx.gbl...
> I have a JS ajax function that calls an ASP page every minute to check
> whether a record is free for editing. It is on a PW protected site with a
1
> hour timeout. For some reason, when the browser is left open & unused, the
> session is not timing out. I'm presuming the ajax call refreshes the
> session..
>

Yep that'll do it

> The problem is, if a browser is left open on a public machine, other
people
> can use the session under the original users credentials. Is there a way
> round this? Like preventing the call from refreshing the session? Or will
I
> need to stick messy JS timers and such like into the web page?

Whether or not ajax was keeping the session awake you would need to give the
user a specific means to logoff. Have a page that calls Session.Abandon as
logout page.

>
> Thanks for you help
> Giles
>
>