How to track user online status?

Question

I would like to write the following parameters:

lastAccessedTime - the time the user visited the site for the last time (usually displayed during the login process)

isOnline is a logical representation if the user is connected to the network or not.

a. Does it make sense to have these variables as part of the User table itself, or should it be handled through a separate user audit table?

b. If a specific SOAP / REST API exposes functionality through API calls, how do you track the above parameters (for example, you would change lastAccessedTime in such cases - this can confuse the user if he enters the portal, the isOnline bit also does not make sense if the user makes API calls )

Answer 1

I would create a session table that references the user. Instead of the isOnline field, I would just run a query for sessions that have been active for the last x time. I would also update this session field with every request, even if this request comes through the API.

This creates some overhead when trimming the session table, but you also do not clutter your user table with non-user information that cannot be truncated.

Answer 2

Make the lastTimeActive field in the user table and update it every time you access the page. Your Online Users list contains all users whose lastTimeActive is within 5 minutes.

Answer 3

I would create another table (userid, lastTimeActive) and refresh and check the table often.

// update update onlineusers set lastTimeActive = getdate() where userid=1234 // check delete from onlineusers where lastTimeActive < dateadd(minute,-5,getdate()) 

Answer 4

The biggest problem with the presence of user tracking (onine / offline) via HTTP is to determine when the user is disconnected.

It is easy to determine when a user has entered the network - the mere presence of an authenticated request assumes that the user is active. However, since HTTP is stagnant, the absence of a subsequent request can mean either that the user is offline or the user is online, but recently did nothing with your application.

Thus, the best thing you can do is to have a timeout, and if the user did not make a request during this timeout, switch to offline.

The simplest implementation would be to have lastTimeActive, as suggested by Jonathan Sampson. However, this will not give you the length of a user session, only an approximation of who is online at the moment.

A more complex approach would be to have lastTimeActive and lastTimeLoggedIn. LastTimeLoggedIn is set during the first auth request, which exceeds 5 minutes from the previous auth request. A user is considered online if there has been an authenticated request in the last five minutes. The session duration for the user is the time difference between lastTimeActive and lastTimeLoggedIn.

If your application also offers the choice of logging out to the user, you also think that this action is also disabled. However, if your application is not a banking application, most likely, users simply close the browser.

Also, avoid any background threads to update the offline / online status of your users. You should use the above logic only when there is an explicit request for the status of a specific user, and you should only update the users that you requested.