Web-development – Handling of user session expiration in MVC-based web application

asp.net-mvcdesign-patternsweb-development

We have an MVC 5 based web application.

Part of functionality includes displaying hierarchical structure as a tree (I use this JavaScript component: https://www.jstree.com/)

Tree is displayed in the left part of the screen and is several levels deep. Each level represents different object type. When user clicks on the tree node an AJAX call is made and extended object details are received as a Partial View and displayed on the right part of the screen using jQuery call like this: $('#EventTreeElement').html(data);

Same logic is used to edit/create delete tree nodes.

All of that works as designed, no problems here. Until user logon session expires. When this happens after user selects another tree node application sends back a view for login screen and it is being displayed as a tree element details which is confusing for the end users.

I implemented a quick and easy fix for this where I have a hidden element on login page and before calling $('#EventTreeElement').html(data); I first check if data contains the text for that hidden element. If so I show a dialog that logon session has expired and redirect user to logon page.

However, as most of "quick and easy" fixes this seems more of kludge than a real solution. For example I need to implement the same business logic again in all cases when user clicked "Edit", "Delete" or "Create" buttons for tree elements.

What are "proper" architectural solutions for this?

In one of our other legacy applications each page includes JavaScript code that starts countdown for the duration of user login session. When countdown reaches 0 the popup dialog appears informing that session has expired. I guess I could do something like this but it also seems like a kludge (event though I know some bank websites use the very same approach).

Best Answer

It sounds like you need to simply redirect to a login page when expiration occurs, instead of staying on the same page.

Depending on your architecture, you may be able to encode some information in the redirect URL, so that when the user logs in again, they're taken back to the same place they were before the redirection occurred.