How can I stay logged in on a website that logs me out for inactivity

December 8, 2021 2:52 PM

My work requires me to do a lot of banking transactions throughout the day. My bank logs me out after a laughably short period of time and then forces me to go through a song and dance to log back in that takes several minutes, seriously slowing down my productivity. What can I do to extend the session? (I am fully aware that it's a security measure. For the purposes of this question, please assume that I am ok with the risk of staying logged in, and that I would only do this on a secured network with no possibility of anyone else accessing my account.) Thank you for your suggestions!
posted by cyberian to Computers & Internet (13 answers total)

It's likely a session cookie expiring, you're not going to be able to change it without the bank making a change on their end or providing you with an alternate authentication mechanism - it's worth asking but there is, by design, very little you can do on your end.
posted by iamabot at 2:59 PM on December 8, 2021

Can you stack the transactions and process them once per hour? Or other suitable time period.
posted by disconnect at 3:01 PM on December 8, 2021 [1 favorite]

You could set a timer when you log in to remind yourself to click something before you're logged out. If you have an iPhone you could make a shortcut to set the timer to the right time with 1 click.
posted by bleep at 3:02 PM on December 8, 2021

Best answer: Will something like a Chrome extension to refresh the tab every few minutes work? Totally depends on what the bank continues new activity-- might work if it's logout after N minutes idle, but if it's just automatically logged out N minutes after login, you may be stuck.
posted by supercres at 3:13 PM on December 8, 2021 [8 favorites]

Mouse jiggler? random choice, but it's a thing.
posted by theora55 at 3:18 PM on December 8, 2021 [3 favorites]

Response by poster: I added a page refresher extension to my browser, set it to reload the page every 2 minutes, and it's working beautifully!

The only problem is, it works on one specific URL instead of the whole domain. This is a problem because I have 19 bank accounts, which you can perform multiple actions on, so as you can imagine that gets into hundreds of possible URLs. I looked at a couple similar extensions and they did not have the ability to refresh all pages in a domain either. If anyone knows of an extension that can refresh any page on a domain, that would be really helpful!
posted by cyberian at 4:12 PM on December 8, 2021 [1 favorite]

Setting the auto-refresher going on one specific URL (e.g. account balances) will probably be enough to keep your session alive browser-wide regardless of how many additional tabs you also open. That's how my bank works, at least.

You might want to move the initial, automatically refreshing tab to its own browser window which you then minimize so you don't visit it and navigate away by accident.
posted by flabdablet at 4:32 PM on December 8, 2021 [2 favorites]

You might want to move the initial, automatically refreshing tab to its own browser window which you then minimize so you don't visit it and navigate away by accident.
This would also prevent the tab you're working on refreshing in the middle of a transaction.
posted by dg at 4:40 PM on December 8, 2021

I use a Firefox add-on called Session Alive which does this for my bank account. Might it help to get one "dashboard" bank where you can see the details of individual accounts? I have one bank which lets me do this in a Mint-type way which is helpful.
posted by jessamyn at 4:43 PM on December 8, 2021 [1 favorite]

Response by poster: A perfectly rational suggestion on keeping the home page open in a separate tab. Except my bank's number one job qualification for web developers is "must be a javascript abuser who hates humanity" so naturally none of the regular navigation methods work - you cannot open any of the URLs in a different tab, loading the main page in a new tab automatically logs you out, etc.
posted by cyberian at 4:50 PM on December 8, 2021 [1 favorite]

What a total PITA.

Tab Auto Refresh seems to remember its settings for any given URL across visits, so once you've turned it on once for a particular page, you shouldn't have to do that again. And at least in Firefox its toolbar icon shows up with a different colour when it's active, so you can immediately see whether you need to poke it or not.

I haven't tried Session Alive. Might be worth a crack before soldiering on with TAR.
posted by flabdablet at 5:28 PM on December 8, 2021

Best answer: It turns out that browser extension APIs are very well documented, and the extension APIs for tabs and alarms (doing stuff based on a timer) make it very easy to build a custom page-refreshing web extension from scratch!

Here is some code for a custom Firefox browser extension that will reload any tabs with URLs that match https://*metafilter.com , if the URL in the tab has not been updated for 1 minute. Presumably you don't bank with metafilter.com , but since this is code for a custom extension, you can tweak some of the parameters in the script to refresh exactly the URLs you want at the refresh frequency you desire.

To try it out, you would need to create a folder on your computer containing two text files: one named manifest.json and a second named background.js . Then you can temporarily load the extension into the firefox web browser by following the instructions given here: Your first extension (developer.mozilla.org) .


boilerplate: i hereby release this code to the public domain, do whatever you wish with it. it is provided "as is". there is no warranty.



Create a text file named manifest.json containing the following text:

{
  "manifest_version": 2,
  "name": "reload-all-matching-tabs",
  "version": "0.1",
  "description": "Reload all tabs with URLs matching a particular pattern after a period of inactiviyt",

  "permissions": [
    "alarms",
    "tabs"
  ],

  "background": {
    "scripts": ["background.js"]
  }

}

Create a text file named background.js containing the following javascript code. You will need to customise the pattern in the URL_MATCH_PATTERN_TO_REFRESH variable so it matches your bank's URL, not metafilter.com :

// This constant defines a URL match pattern that should be refreshed.
// Ref:  https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Match_patterns

let URL_MATCH_PATTERN_TO_REFRESH = "https://*.metafilter.com/*";


// An alarm starts counting down whenever a URL of a tab is changed,
// and the URL matches the pattern above. When the alarm goes off
// we reload the tab.
// If the URL of a tab is changed to something that doesn't match the
// pattern above, we clear the alarm for the tab (if any).


// These constants control how often we will reload a tab:

let ALARM_DELAY_MINUTES = 1.0;   // delay until first alarm
let ALARM_PERIOD_MINUTES = 1.0;  // period since previous alarm



// Figure out if tab with given tabId needs to be refreshed.
//
// n.b. this implementation is not very efficient since we query
// all the tabs instead of inspecting the single tab we already
// know about, but it lets us simplify the problem of url matching
// by reusing
// https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Match_patterns
async function NeedsToBePeriodicallyRefresh(tabId) {
    try {
        let matchingTabs = await browser.tabs.query({url: URL_MATCH_PATTERN_TO_REFRESH});
        for (let tab of matchingTabs) {
            if (tab.id === tabId) {
                return true;
            }
        }
        return false;
    } catch(error) {
        console.error(error);
        return false;
    }
}


// Whenever a tab URL is updated, decide if the URL in the tab is one
// we want to refresh or not.  If the URL is one we want to refresh,
// create the corresponding alarm. In the case where an alarm for the
// tab already exists, this will reset the countdown.
// If the URL is not one we want to refresh, clear the corresponding
// alarm.
async function handleTabUpdated(tabId, changeInfo, tabInfo) {
    try {
        let alarmName = tabId.toString();
        let toPeriodicallyRefresh = await NeedsToBePeriodicallyRefresh(tabId);
        if (!toPeriodicallyRefresh) {
            await browser.alarms.clear(alarmName);
            return;
        } else {
            let alarm_info = {
                "delayInMinutes": ALARM_DELAY_MINUTES,
                "periodInMinutes": ALARM_PERIOD_MINUTES
            };
            await browser.alarms.create(alarmName, alarm_info);
        }
    } catch(error) {
        console.error(error);
    }
}

browser.tabs.onUpdated.addListener(handleTabUpdated, {"properties": ["url"]});


// Whenever a tab is removed, clear the corresponding alarm.
async function handleTabRemoved(tabId) {
    let alarmName = tabId.toString();
    try {
        await browser.alarms.clear(alarmName);
    } catch(error) {
        console.error(error);
    }
}

browser.tabs.onRemoved.addListener(handleTabRemoved);


// Whenever an alarm associated with a tab id fires, reload the
// corresponding tab
async function handleAlarm(alarmInfo) {
    try {
    let tabId = parseInt(alarmInfo.name);
        await browser.tabs.reload(tabId);
    } catch (error) {
        console.error(error);
    }
}

browser.alarms.onAlarm.addListener(handleAlarm);

posted by are-coral-made at 3:01 AM on December 9, 2021 [13 favorites]

A perfectly rational suggestion on keeping the home page open in a separate tab. Except my bank's number one job qualification for web developers is "must be a javascript abuser who hates humanity" so naturally none of the regular navigation methods work - you cannot open any of the URLs in a different tab, loading the main page in a new tab automatically logs you out, etc.

As a possible workaround, you could just leave one of the web requests the site makes open.

You'll have to be a bit adventurous -- reload the site with the Developer Tools (F12) open. (This is assuming you're in Chrome but Firefox is pretty similar.) Click on the "Network" tab, then "Fetch/XHR" in the filter.

These are all the requests the site Javascript is making to the server. Choose one where the method is "GET". If you right-click it and "open in new tab" you should probably just see some JSON data.

Now you have a page URL you can automatically refresh to keep your session alive. Maybe.

(The catch here is that you want a URL that's *retrieving* data, not sending it to the server. But if you're inspecting a basic site load, the vast majority of requests should be retrievals. If you choose wrong you'll likely just get an error message when you open it in a new tab.)

(And no this isn't "hacking" by any stretch of the imagination, no matter what the Governor of Missouri says.)
posted by neckro23 at 6:55 AM on December 9, 2021 [2 favorites]