Session expiration issue

36 Posts

phatphug Reply #1, 14 years, 10 months ago

Hello.

I'm building a website where ideally user sessions should expire after around 20 minutes of inactivity. On this website, users do not perform a login, but I do make use of $_SESSION[] variables throughout the site.

By default I've found that sessions appear to last much longer than this, about a week I believe.

There are two settings in the system settings:
- session_cookie_lifetime - According to the description this is only used if a user logs in and uses the 'remember me' option. This shouldn't be relevant to me because the visitors to my website do not login?
- session_gc_maxlifetime - I guess this alone should determine the lifetime of sessions. Is it used to override the php.ini "session.gc_maxlifetime" setting?

I've set both of these to 1200 (20 mins), and while the PHPSESSID cookie does expire after 20 minutes, it doesn't take into account whether the user has been active in the past 20 minutes or not.

For example: If I visit the website at 9:00am, the session cookie will expire at 9:20am. If I click on a link at 9:18am I think the expiration date should be extended by another 20 minutes (to 9:38am). This does not happen so once the clock hits 9:20am the users session is reset and they are left wondering what just happened.

Am I missing something with the session settings here?

I've also tried reverting session_cookie_lifetime back to the default of 1 week (604800) with session_gc_maxlifetime remaining at 1200. When I do this, sessions remain active after 20 minutes of inactivity.

Is it possible to expire sessions in this way? or would I need to manually code a plugin to detect and destroy sessions which are inactive for longer than 20 mins?

thanks for your help.

36 Posts

phatphug Reply #2, 14 years, 10 months ago

I decided to go ahead with the plugin idea and this seems to work.

Not sure if this is the best practice, but will keep it for now.

// Plugin Settings
$inactivity_limit = $modx->getOption('session_gc_maxlifetime');
$session_var_nav = 'sk_last_active';

// Current time
$current_time = time();

// Is this an existing session?
if(isset($_SESSION[$session_var_nav]))
{
	if($current_time - intval($_SESSION[$session_var_nav]) > $inactivity_limit)
	{
		// The session has expired, reset the vars
		$_SESSION = array();
	}
}

// Make a note of the last time this session was active
$_SESSION[$session_var_nav] = $current_time;

I'm running this plugin on the OnWebPageInit event.

It wipes all $_SESSION vars after a period of inactivity determined by session_gc_maxlifetime.

I've set session_gc_maxlifetime to 1200 (20mins) and session_cookie_lifetime is at 604800 (7 days).

Any comments/ideas appreciated, as this behaviour with sessions is something I need in quite a few MODX websites.

MODX Staff
10,725 Posts

opengeek Reply #3, 14 years, 10 months ago

You can configure session_cookie_lifetime in MODX System Settings (or session.cookie_lifetime in your PHP INI). By default, it is set to 7 days in MODX Revolution.

Jason Coward
Chief Architect @ MODX
http://www.jasoncoward.com | http://twitter.com/drumshaman | https://github.com/opengeek

36 Posts

phatphug Reply #4, 14 years, 10 months ago

Thanks for your reply.

I think the issue I've had is that the session does not expire even if inactive for longer than 'session_gc_maxlifetime' seconds. Perhaps that is not how this setting was intended to function?

I could reduce session_cookie_lifetime to match session_gc_maxlifetime (20 mins), but doing so means that every session will expire after 20 mins, regardless of whether the user is active or not.

What I desire is some way of expiring sessions after a period of inactivity and not a fixed period of time after their session was first created.

MODX Staff
10,725 Posts

opengeek Reply #5, 14 years, 10 months ago

Session garbage collection is completely different from session expiration/lifetime. Garbage collection is a process that is run based on several settings to delete expired sessions from storage. Generally, it should be set longer than the expiration/lifetime of the session cookies. Also note, on shared servers, session garbage collection occurs on every request, so if different users on the system use different settings for this, it will affect ALL applications on that shared server.

Jason Coward
Chief Architect @ MODX
http://www.jasoncoward.com | http://twitter.com/drumshaman | https://github.com/opengeek