Probably the simplest way to do this is just using an additional
before_filter, something like:
class ApplicationController < ActionController::Base
include LoginEngine; include UserEngine
session[:user_timestamp] = Time.now
elsif (Time.now - session[:user_timestamp]) > 600 #seconds
session[:user] = nil # log them out
session[:user_timestamp] = nil # reset the timer
flash[:message] = “Your session has timed out. Please
store_location # so when they do log in they come back here
access_denied # redirect them to the login page
return false # stop the filtering
… I’ve not tested that at all, but something along those lines
should work. To require the user to re-enter their password, you could
a line of code like below to the top of only those certain actions
(presuming that you’ve supplied a form on those pages which puts the
password into params[:password])
if User.authenticate(current_user.login, params[:password]).nil?
flash[:message] = “Wrong password!”
Essentially you’re just checking if the current user can be
authenticated with the password they’ve just supplied. Again - I’ve
not tested that but it should be something like this.
On 1/31/06, Jonathan W. firstname.lastname@example.org wrote:
minutes have passed I would like the user to have to log back in.