force user to re-login after 4 hours - how?

Question

Does anyone know of a way to force a logged in user to re-login after say 4 hours? or at a particular time to day?

For example, if they logged in at 9am, can we force them to re-login at 1pm?

Answer 1

You can write javascript which will start on wp_login action, count 4x60x60 seconds and redirect user to URL generated by wp_logout_url().

Update: it's a good idea to force logout only after N minutes the user is idle. You can get the idea and link to source code in jQuery idleTimer plugin article by Paul Irish. Unfortunately, demo does not work.

Answer 2

You can programatically logout a user in Wordpress by calling the wp_logout() function. To apply this to your 4 hour rule, consider the following code:

function user_update_login($login) {
    // function fires when a user logs in

    global $user_ID;
    $user = get_userdatabylogin($login);

    // save the current time when the user logged in
    update_usermeta( $user->ID, 'last_login', time() );
}
add_action('wp_login','user_update_login');

function check_time_limit() {
    // populate the user objects
    get_currentuserinfo();
    global $user_ID;

    // only run if the user is logged in
    if($user_ID) {
        // get the last login time
        $last_login = get_user_meta($user_ID, 'last_login', TRUE);

        // if the current time is greater than the last login
        // + 14400 seconds (4 hours) the user will be logged out
        if(time() > ($last_login + 14400)) {
            wp_logout();
        }
    }
}
check_time_limit();

Putting this code in your functions.php file will log ALL users out after 4 hours. You could also move the call to check_time_limit() anywhere within your theme if you only want this rule to apply to specific pages etc.

Answer 3

The easiest way is to change the authentication cookie expiry time.

add_filter('auth_cookie_expiration', 'wase_85171_expiry',10,3);

function wase_85171_expiry($expiry, $user_id, $remember) {
  return 14400; // or calculate the time remaining till the time you want it to expire
}

People can extend the cookie expiry in the browser, but I don't believe anyone will bother