MODx sessions expire, despite activity

I find that Manager frequently loses its SESSION cookie somehow, and the result is that I get dumped back to the login screen. Sometimes this occurs after only two or three operations, thus there has not been a long period of inactivity. Users are also complaining of this on the frontend as well. Is this a server configuration issue?

Yes, ATM, MODx sessions are at the mercy of your PHP session configuration.

Any advice on how to proceed? My app is on a hosted server, so my access to configuration is limited to what I can do through htaccess and ini_set/ini_get. What settings should I investigate?

The problem is that a shared host uses a common directory for storing the session files. By default, PHP will perform "garbage collection" on any files that show no activity within the last 22 minutes. This can be changed in the php.ini file, in .htaccess files, and with functions in .php scripts. The problem with this is that you might set it in your site for 60 minutes, but somebody else on the same server set theirs for 10 minutes. PHP doesn’t keep track of who set what value, it just uses the shortest value setting it finds.

You can specify a session_save_path() location to save your site’s session files rather than use the default (usually /tmp) to someplace else, but the location has to be writable by your php scripts, and then you have to take care of removing old session files yourself. And they stack up pretty fast, even for a site with moderate use.

http://www.php.net/manual/en/function.session-save-path.php

MODx uses a technique of requesting an image file every few minutes in the Manager to keep the session active, but this doesn’t always work as expected.