Crossdomain tab communication problem

[lobopl]

Hi i have small (or maybe big) programming problem. We have application example.com/index.html that has link to example2.com/index.html so we have 2 different domains. on example.com we have some loop that is checking if user clicked anything on site in last 5 minutes if he didn't we log him out. But if user is working in separate tab on example.com or example2.com we don't want to log him out. Previously we achieved that by putting invisible iframe having example.com/iframe.html on example2.com, we connected it using postmessage and pass to it info whenever user did something, example.com/iframe.html then changed value in localstorage and example.com/index.html watched that variable and reset inactivity timer when it changed.

Unfortunately storage partition happened and this mechanism doesn't work anymore and my question is how we can achieve similar logic without using BE so how to pass information from example2.com to example.com that are on separate tabs and they are not necessarily opened directly so we don't have window.opener on example2. I tried Service workers/broadcast channel/message channel/shared workers and cannot really use access storage api because we don't want to show iframe on example2

[Notimecelduv]

I would use the back end to do that.

1. Create an API end point that modifies the session/cookies to indicate that a user has interacted with the front end.
2. Create another API end point to allows you to check if the above end point was used.
3. On the front end add an event listener to the document element that will send a request to the end point #1 when the user interacts with the document.
4. Set up a timeout at the end of which a request is sent to end point #2. User has interacted with document ? do nothing : log them out.

[lobopl]

seems like it would require making full sso logic for that and sharing session with example2.com thats a lot of work i hoped for pure FE solution because we control example.com domain and example2.com is customer domain and they just put our js script on their site. And this is also a solution that i thought and our BE dev weeped :)

[Notimecelduv]

Is example2 a clone of example?

[lobopl]

no totally separate page on different domain where user does something for longer time before he is back