Java Development Tools

Hi!

we have a requirement to display a warning message to users just (1 minute) before the session is going to time out, and ask the user if he wants to extend the session or close the session( in which case we close the browser window). We have come up with a probable solution but would like to know what other people are doing/will do in similar scenarios.

Here is what we came up with:

1. On every page load we set/update a cookie which is meant to track the session time out. And we have a javascript timer that counts down user's inactivity. If any PPR occurs on the page, then we plan to add a hook to the PPR javascript calls so that we can update the time out cookie not only on page load/refreash but also on every PPR call made to the server.

We have a worry that we are doing everything on the client side solely depending on javascript.Is our approach in the right direction? Is there any better way to achieve the same? Are there any pitfalls/security issues involved in our design?

2. I have read in some articles/forum threads that we can poll the server on a regualr interval to find out the time remaining for the session to expire and once we get time to last minute we can display a javascript popup to the user. But I have a doubt that wouldn't polling itself refresh the user activity on the server and reset the session timeout to normal on every poll? In that case wouldn't we always get the same time-remaining info for every poll? Have I mis-understood some thing here? can some one explain how to implement the session time out based on polling to the server?

3. Any new ideas are welcome!

Thanks and Regards,

Samba