PHP session timeout

[arm207]

Hi,
Is it possible to provide php session timeout functionality by modifying php.ini? How?

If the above is not possible, does anyone know of an example on how to do php session timeouts?

 

[arm207]

assume we are using Tomcat server.

 

[jpadie]

you can change the php.ini to create the equivalent of a time out:

set
session.gc_probability = 100
session.gc_maxlifetime = 600
session.cookie_lifetime = 600

the first line forces php to run garbage collection every time a session is started
the second line specifies the number of seconds that the session should endure
the last line specifies the number of seconds that a session cookie should endure.

or as an alternative that does not involve changing the php.ini file ...

you could store the last accessed time as a session variable and logout the user if they try to come back to the site after the expiry of a time period

session_start();
define ("TIMEOUT", 600);
if (isset($_SESSION['loggedin']):
  if (isset($_SESSION['lastaccess']) && (($_SESSION['lastaccess'] + TIMEOUT) > time())):
      $_SESSION['lastaccess'] = time();
      //login ok
  else:
    unset($_SESSION['loggedin']);
    unset ($_SESSION['lastaccess']);
    echo "You're session has expired. Please login again";
    display_login_form();
  endif;
else:
 echo "Please login";
 displayloginform();
endif;

 

[arm207]

in the example above, is TIMEOUT defined to be 600 seconds or minutes???

 

[jpadie]

TIMEOUT is defined as 600 (no unit) but the use against unix timestamps means that it equates to seconds (i.e. 10 minutes).