One of the common security issues is tracking user’s activities based on the events we want to listen to (mouse click, scroll, typing, etc.) and let us know when the user has not triggered those events in a given time period so we can logout the user to prevent attack such as hijacking from occurring.
I’m asking here does your project handle idle detection? By third party library or your own implementation?
Thanks.
Hi,
I think there are two parts to this question; one about the token handling itself and the other about the inactivity detection.
The token renewal process, which was previously automated, now includes a new mechanism that allows you to toggle this feature on and off.
This change gives you greater control over the token renewal behavior, allowing you to customize it based on your specific needs and preferences. Meaning you can prevent that the token renews, if for example the tab is for a while in the background. Please note, however, that the exact timing of the renewal will be a custom implementation that varies from project to project.
This has been changed in ticket A12-14253
Our project is now also working on such an implementation of an inactivity detection. Which is mainly an internal service that uses the mentioned new functions
TokenManagement.getInstance().startService();
TokenManagement.getInstance().stopService();
For us, we will try to go with adding service calls to the generic click events, as it seems to be sufficient for our project (for now). If you need more control over that, maybe take a look at libraries like https://idletimer.dev/ and see if them fit your needs.
Cheers,
Jörg
Thanks so much for your input