fix(session): count keyboard and touch as activity, not only mouse movement - #2338
Merged
hirokiterashima merged 1 commit intoSep 4, 2026
Conversation
…vement SessionService decides whether a user is active from lastActivityTimestamp, which was updated only by mouseMoved(), whose only callers were three document:mousemove host listeners. A user who is typing, and not moving the mouse, was therefore treated as inactive and shown the session timeout warning while working. With the default 30 minute timeout, calculateIntervals gives a showWarningInterval of 1620 seconds, so the dialog appears after 27 minutes of typing. keydown and touchstart join mousemove in all three components, and mouseMoved is renamed userIsActive because it no longer answers only about the mouse.
hirokiterashima
self-requested a review
September 4, 2026 16:26
hirokiterashima
approved these changes
Sep 4, 2026
hirokiterashima
left a comment
hirokiterashima
left a comment
Member
There was a problem hiding this comment.
LGTM. Thanks for finding and addressing this issue.
Will merge despite the failed Github actions build phase. This is due to the PR coming from a fork branch and GitHub not making the AWS secrets available to the runner, not because there is an issue with the changeset. I was able to verify a build locally with this branch. The long-term solution is to use OIDC federation instead of static keys.
Member
|
🎉 This PR is included in version 5.238.2 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
SessionServicedecides whether a user is active fromlastActivityTimestamp, which was updated only bymouseMoved(). Its only callers were three@HostListener('document:mousemove')handlers, invle.component.ts,authoring-tool.component.tsandclassroom-monitor.component.ts.Keyboard input and touch were therefore not treated as activity, so a user who is typing and not moving the mouse is considered inactive and is shown the session timeout warning while they are working.
To reproduce: sign in as a student, open a step with an Open Response component, and type using only the keyboard. With the default
server.servlet.session.timeout=30m,calculateIntervalsgivesforceLogoutAfterWarningInterval = min(1800 * 0.1, 300) = 180andshowWarningInterval = 1800 - 180 = 1620, so "You have been inactive for a long time. Do you want to stay logged in?" appears over the editor after 27 minutes.The changes:
keydownandtouchstartjoinmousemovein all three components, so the three ways a user can interact all postpone the warning.mouseMoved()is renameduserIsActive(), since it no longer answers a question about the mouse. The three components and the spec are the only callers.Two notes on scope. The user is not necessarily logged out:
checkForLogout()callsforceLogOut()only when the server reports the session inactive, and the 60 second autosave innode.component.tskeeps the server session alive while a component is dirty, so what this fixes is the interruption rather than a logout. And this is not #1038, which reports sessions not timing out at all.touchstartis included becausemousemovemay never fire on a touch-only device, which would put a tablet user in the same position permanently.