IMO, you should opt for client-side code to find out the idle time out,
once idle time out reaches you can easily log out the user. From
client-side code you will have several ways to track the idle time -
cookies, browser cache etc. You should not go for the option 1 which is
server side, for every click on the page/form/link you need to send the
backend request which will put your backend servers under stress.