force session expire

Anon

How do I set a session to expire after a certain amount of time (i.e. 15 minutes) so that if the person moves to a page after expiration or refreshes a page, they are forced to log back in.

Also, is there a way to do automatic clean up if a session automatically expires. Currently the script creates temp directories and files for each session that need to be "cleaned" up after a session ends or expires. Since these files and directories are outside of the data stored in "sess_asdf890230jaf", they end up sticking around unless another script cleans them up. Is it possible to have PHP recognize when a session is expired , abandoned, ended, etc and have it trigger the "clean up" scripts.?

Anon

set a variable with the timestamp of the last time they moved in the session. everytime they move check the timestamp to see if 15 minutes have passed. if 15 minutes have passed, destroy the session using session_destroy() and send the user back to the login page.

Anon

Excellent Idea. Thanks.

Any thoughts on how to automate the clean up script. I've got it working provided that the user logs out, but more often than not users simply close a window or quit the browser without loging out.

When they fail to log out, it leaves the session direcotories and files lying around.

Currently I'm logging the session_id and a timestamp into a mySQL table and am planing to implement a Perl script to run as a crontab job to purge the abandoned sessions.

Your idea for the timeout variable will allow me to trigger "expiration" clean up, so all I need to do is deal with the abandoned sessions. I'd prefer some PHP method but will use the Perl crontab if necessary.

Thanks.