my sessions want die

[Anon]

I have a probem with sessions

i have a login-community-thing and the user will be offline end the sessions dies after 30min BUT if the close the browser window and start it agin they will be loged in (if they do this process in less then 30 minutes) 🙁

i think i have a mayor security problem here..

this is my code:

when u login i have this

session_register("Username");
session_register("ActiveAt");

$ActiveAt=time();

then i use this 2 C if hte people are active

if(!isset($ActiveAt)){
session_destroy();
}
if(isset($ActiveAt) && time()-$ActiveAt>1800){
session_destroy();
}
else

$ActiveAt=time();

and i use this to get al the online info etc..

IF( $HTTP_SESSION_VARS["Username"] != '')

is there anyone who know how to fix this??

[Anon]

I'm wondering if $ActiveAt is really holding a value or not. Try echo()'ing $ActiveAt on one of the pages that has this problem and see if it actually returns a time.

If in fact $ActiveAt is empty (yet still set), time() - $ActiveAt will always be greater than 1800, because you'll be subtracting 0.

You could also try writing your code to check if:

$x = time();
if ((x + $ActiveAt) - x > 1800)

This way, if $ActiveAt is greater than 0, you'll end up with the same result as before. But if $ActiveAt -is- acting as 0, you'll end up with 0 (which is obviously less than 1800).

These are just guesses, as I'm fairly new myself, but hopefully this will help.