Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

Does anyone know of a way to force a logged in user to re-login after say 4 hours? or at a particular time to day?

For example, if they logged in at 9am, can we force them to re-login at 1pm?

share|improve this question
add comment

3 Answers

You can write javascript which will start on wp_login action, count 4x60x60 seconds and redirect user to URL generated by wp_logout_url().

Update: it's a good idea to force logout only after N minutes the user is idle. You can get the idea and link to source code in jQuery idleTimer plugin article by Paul Irish. Unfortunately, demo does not work.

share|improve this answer
    
this is a good idea, complementary to what J.Chin Asked for. But I'm pretty sure it would be safer on the server side (in PHP then). Ben Then JS could still be used in order to hide still opened page –  Christian Feb 9 '13 at 9:10
add comment

You can programatically logout a user in Wordpress by calling the wp_logout() function. To apply this to your 4 hour rule, consider the following code:

function user_update_login($login) {
    // function fires when a user logs in

    global $user_ID;
    $user = get_userdatabylogin($login);

    // save the current time when the user logged in
    update_usermeta( $user->ID, 'last_login', time() );
}
add_action('wp_login','user_update_login');

function check_time_limit() {
    // populate the user objects
    get_currentuserinfo();
    global $user_ID;

    // only run if the user is logged in
    if($user_ID) {
        // get the last login time
        $last_login = get_user_meta($user_ID, 'last_login', TRUE);

        // if the current time is greater than the last login
        // + 14400 seconds (4 hours) the user will be logged out
        if(time() > ($last_login + 14400)) {
            wp_logout();
        }
    }
}
check_time_limit();

Putting this code in your functions.php file will log ALL users out after 4 hours. You could also move the call to check_time_limit() anywhere within your theme if you only want this rule to apply to specific pages etc.

share|improve this answer
    
no because it only fires if $user_ID is set, i.e the user has to be logged in again before the check will run and thereby the last_login meta value will be updated first. works fine for me. –  tobbr Feb 9 '13 at 11:05
    
yes, after another 4 hours, thats the whole point. –  tobbr Feb 9 '13 at 11:11
    
lol, my mistake, going to delete it –  Mark Kaplun Feb 9 '13 at 11:11
add comment

The easiest way is to change the authentication cookie expiry time.

add_filter('auth_cookie_expiration', 'wase_85171_expiry',10,3);

function wase_85171_expiry($expiry, $user_id, $remember) {
  return 14400; // or calculate the time remaining till the time you want it to expire
}

People can extend the cookie expiry in the browser, but I don't believe anyone will bother

share|improve this answer
    
where do I add this code? –  J. Chin Feb 10 '13 at 16:23
    
at your themes functions.php file –  Mark Kaplun Feb 10 '13 at 20:01
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.