Loosing Sessions

herreram

Loosing sessions

Hi!

I'm using sessions on my site with the following configuration on php.ini:

session.save_handler = files
session.save_path = /tmp
session.use_cookies = 1
session.use_only_cookies = 1
session.name = PHPSESSION
session.auto_start = 0
session.cookie_lifetime = 0
session.cookie_path = /
session.cookie_domain =
session.serialize_handler = php
session.gc_probability = 1
session.gc_dividend = 100
session.gc_maxlifetime = 10800
session.referer_check =
session.entropy_length = 0
session.entropy_file =
session.cache_limiter = nocache
session.cache_expire = 180
session.use_trans_sid = 0

My users can start sessions and navigate the site with no problems for a while. After a couple of minutes (no more than 20), the session ID is lost and a new one is created, loosing all the session variables. This happens at any given time.

I haven't figured out the cause of this. When the current session is lost, a new one is generated, but the old session file at /tmp is still there with the complete variables info.

I'm using Linux RedHat 7.3 on Intel, Apache 1.3.27 and PHP 4.3.0

Any help will be apreciated.

Mauricio

eriksmoen

try editing these variables:

session.cookie_lifetime = 0
session.gc_maxlifetime = 10800

*note: these are your settings.

herreram

Thanks Nate

I already tried different values on those directives. I have set both of them up to 24 hours, and I still get lost sessions.

eriksmoen

.
try turning the cache on and setting the cache expire... with your config, thats about all i can help you with. I do it the hard way and create my own sessions, as well as use cookies. but i would definitely try the cache setting. turn it on and give it a whirl.

herreram

I tried that, and didn't do.

Could it be something with the garbage collection process? or perhaps filesystem?

How did you do your session method? on a database? or using files?

eriksmoen

heh... i use mysql and text files... not the most secure, but it works. the registration process takes the username and converts it to md5. the md5 portion is what i use as the "session" and the session name (which links to the user) is stored in a cookie only for an hour after the login. all links have the session tagged to the end of it, so stuff just gets passed around that way ($_GET). anyhow, thats what the database is for. the registration also creates a txt file with another unique number, and all information gets stored in there. it's a pain in the arse, but it works fine wherever you port it.

JakesSA

are you sure that you dont have have a session_destroy() somewhere in your site? killing of that session?

herreram

Thanks Nate! Now I have a good idea of how to do sessions over a database if I need to.

Jakes, I'm pretty sure there's no session_destroy() anywhere.
The session is lost on any given page and on any given time. There's no pattern here. Based on my users feedback, their sessions can be lost after navigating two or twenty pages.

Now, what I am testing now, is that sessions are lost when a new user logs in and creates a new session. I came to this because I noticed that the time between a new session is created and the sessions are lost, is almost null.

Could this be happening even if the GC is set to:
session.gc_probability = 1
session.gc_dividend = 100
?

I read on the php.net comments of the Session functions that the GC is broken on Linux or something like that. Anybody knows about this?

Mauricio

JakesSA

I have never come across something like that before ??? I see there is an update on php, now 4.3.1. Try installing that and see what happens. It could be a bug that was fixed...not to sure I havent checked the list.

Good luck