title: How do I force expiration of an ASP.Net session when a user leaves the site?
body: <p>We have a scenario in which we like to detect when the user has left our site and immediately expire their .Net session. We're using Forms Authentication. We're not talking about a session timeout, which we already have. We would like to know when a user has browsed away from our site, either via a link, by typing in an address or following a bookmark. If they return to our site, even if right away, they will have to log back in (I understand this is not great usability - this is a security requirement we've been given by our client).</p>
  
  <p>My initial instinct is that this is either not possible, or that any solutions will be extremely unreliable. The only solutions we've come up with are:</p>
  
  <ul>
  <li>Add a JavaScript onBlur event handler that tells the server to log out the session when the user leaves the site.</li>
  <li>Once the user has logged in, check the HTTP referrer to ensure that the user has navigated from within the site.</li>
  <li>Add AJAX polling back to the server to keep the session refreshed, possibly on a 10-second interval. When the call isn't received on time the session would end.</li>
  </ul>
  
  <p>The onBlur seems like the easiest, but possibly least reliable method - I'm not sure if it would even work. There are also issues with the referrer method, as the user could type in an address within the site and not follow a link. The AJAX method seems like it would work, but it's complicated - I'm not even sure how to handle it on the back-end. I'm thinking there might also be scenarios in which that wouldn't always work.</p>
  
  <p>Any ideas would be appreciated. Thanks.</p>