I love the session handling on the backend CP. The prompts that come up on session expiration after setting 'userSessionDuration' => 'PT5M', in config/general.php are exactly what I want to use on the frontend website, (shown below).

CP Password Prompt

I would like to use this logic on the frontend to force session-ends after x minutes. Doing some digging I can see the logic lies in UserController under actionGetAuthTimeout(), and this is polled while I'm on the CP every minute. My question is whether I would have to manually run the controller constantly in the background and make the modal pop up? is there a more elegant method I've missed?


2 Answers 2


What you want is this:

// Returns how many seconds are left in the current user session.
// (int) The seconds left in the session, or -1 if their session
// will expire when their HTTP session ends.

You can then combine this with a Javascript setTimeout when the page loads so you can trigger whatever messages you need.

Edit: You can use this in your template files:

{% set authTimeout = craft.session.getAuthTimeout() %}
  • Thanks for your answer, did you get this to work in a template on a non-CP page? Are you sure userSession is available to the front end? I tried calling userSession on index as a test, and just got Method "userSession" for object "Craft\CraftVariable" does not exist.
    – Merlin
    Feb 3, 2016 at 9:10
  • I edited your post (I hope you don't mind), it was session rather than userSession on the front end! I was however hoping to include all the js to create the logout modals, etc?
    – Merlin
    Feb 3, 2016 at 9:43
  • Whoops, was looking at the service name when writing that template snippet! Thanks for the edit though @Merlin :) Feb 3, 2016 at 11:41
  • I'll mark this as the answer as it is essentially what I wanted, and the JS, well I'll just have to build that myself. Thank you Benjammin'!
    – Merlin
    Feb 3, 2016 at 14:36

I wanted to do something similar to this, but ran into the problem that if they were on another tab taking actions, they could extend the timeout, which would render the original set timeout to no longer be correct.

To account for that, I created a controller in one of my plugins which would get the timeout for the user, and return that.

public function actionGetAuthTimeout()
    $authTimeout = craft()->userSession->getAuthTimeout() * 1000;


Then, in the routes.php file, add a route for that controller action, such as

'getAuthTimeout' => ['action' => 'pluginName/controllerName/getAuthTimeout'],

Then, in the front end, you can access that making sure to pass the param to not extend the session

document.addEventListener("DOMContentLoaded", function(event)

// Check the remaining timeout until the user is logged out
function checkTimeout()
    $.get('/auth/getAuthTimeout&dontExtendSession=1', function(timeout)
        if (timeout <= 1000)
            // I chose to force log them out too, just to make sure

            // Do whatever else you want
            }, timeout)

On a side note, if you want to make this a lot easier for testing, just add the following line in your craft/config/general.php file to expire after 10 seconds: 'userSessionDuration' => 'PT10S',

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.