Enhancing user security with Auto-lock Chrome Extension

Hi @CharlieDelamare !

Hate to tell you, but someone else posted a similar “hack” here a while ago 😉:

• Auto logout + keyboard shortcut

And that script (if corrected according to my update at the bottom of the thread) works accross other browsers, too, if used with approriate browser extensions 😎. Let’s also show support beyond chrome - support firefox 😬 !

However, the timeout until locking session is not 100% reliable - I have not yet figured out the cause (no time to invesetigate), I believe it must be something with the browser pausing java script execution when put in background or the tab not beeing in focus.

Would be great to have this feature without some java script hack, directly integrated in the mews app…

Kind regards,

Jean-Philipp.

Hey @j.spiess,

Thanks for the feedback.

Initially I’ve just planned to support Chromium, this has a 70% market share (Chrome + Edge) so should cover most of our users. The nature of it being a full extension published to the Chrome Webstore also makes it easy for non-technical users to install. At some point I might look to extend this to Firefox, but no plans at the moment.

The script you shared is run independently in each tab so if you have Mews open in two tabs, one of which you haven’t used in X minutes, you’ll find your account is locked in that tab, and therefore locked in all tabs. You’re also correct, Chrome essentially puts the tab to sleep when it’s in the background, which means the user menu takes a few seconds to load when the tab is in the background.

The extension I’ve shared solves both of these problems by having a service worker in the background that aggregates the timeout across all Mews tabs you have open, meaning if you’re working in one and not another, you won’t be logged out until you’ve been inactive in both for more than 10 minutes. The script will also try to click the lock button once every 0.5 seconds, for 10 seconds to wait for the user menu to load when the tab is in the background.

Here’s the code for the extension if you’d like to check it out yourself.

I absolutely agree, I’d love to see this in Mews natively. I spoke with our Users Product Team, and they said this is something they plan to look into around the middle of next year. Note that PCI DSS requirements are changing next year and we believe as part of this an auto-lock/logout feature will be required for systems handling card details. We’re unsure if this will exactly apply to Mews, as card details are actually never handled by us, but regardless, when the time comes we’ll evaluate accordingly and implement the necessary functionality.

In the meantime, this is an out of the box, simple solution, that should work for everyone.

Thanks,

Charlie!

Hi @CharlieDelamare !

I love your solution - well done! The extension is definitely the superior solution! I know Firefox has only like 5 % market share, and that’s a pity… I am old enough to remember the time when one single browser (IE) had a similar market share :-) … and those are not fond memories!

BTW: I am using MEWS almost exclusively in FireFox and am glad that it works really well across all major browsers.

Kind regards,

JP.

@j.spiess I come bearing great news! I translated the above extension to Firefox and submitted it to their store. You can find it here. Note that I haven’t actually tested it, I don’t use Firefox, but there should be no reason it doesn’t work. Let me know if you have any feedback!

Hi @CharlieDelamare !

That’s awesome! However, the extensions do not work for me … I tried it in Firefox and also in Chrome, but it doesn’t lock at all - not when in focus, nor when in background …

Regards,

Jean-Philipp.

Hi @CharlieDelamare !

I have experimented a little bit with your chrome extension. My observation: when I have the developer console for the service worker of your extension open, I can see the console messages and locking works. However, when I don’t have the developer console of the extension’s service worker open, locking does not work at all … I believe that this is due the time limit a service worker keeps active after last activity, so I guess that the serviceworker ist stopped by chrome after 30 sec. or 5 minutes - im not sure which limit applies - and thus the time limit never expires. And opening the developer console keeps the service worker alive somehow, I believe. I could be totally wrong, though - someone with chrome extension development experience here ? :-) I have googled around a little bit about service workers keep alive, but I admit that I have no experience with broweser extensions and browser service workers.
Regards,

Jean-Philipp.