[Resolved] i want my session to timeout after 10 minutes

sneakyimp

i have a site that users log into. i determine their login status by setting and checking some session variables. my client wants anybody who is logged in but remains idle for more than 10 minutes to be logged out (in case they leave their computer or something).

is it possible to set up my session handling so that sessions will expire after 10 minutes? it's important that this doesn't affect other sites on the same PHP server. right now my PHPinfo has this:

session.auto_start Off
session.cache_expire 180
session.cache_limiter nocache
session.cookie_lifetime 0
session.gc_divisor 100
session.gc_maxlifetime 1440
session.gc_probability 1
session.use_cookies On
session.use_only_cookies Off
session.use_trans_sid On

LordShryku

With php session handling, you could do 1/1 gc_probability and a gc_maxlifetime of 10 minutes, but that requires constant session usage and doesn't inform them that their session has timed out. For this type of timeout, it's good to kill the session and send them to a page that lets them know it's timed out. I'll usually put a meta refresh tag in the header to redirect to a page that does this.

sneakyimp

you again!

thanks, shryku.

i think i understand. if you put a META REFRESH tag in the HTML, the browser can, after a certain amount of time, redirect to a logout page that says "you have been logged out". am i getting that right? if so, that sounds like the ideal solution.

i wonder if that works for all browsers?

i think i have some META REFRESH code around here somewhere...will check it out. or would w3.org be a good place to read about it?

LordShryku

First place I usually go is google. I don't think any browsers have problems with meta refreshes, but you could also make some javascript, just in case.

<html>
<head>
<meta http-equiv="Refresh" content="600; url=/logout.php" />
<script type="text/javascript">
setTimeout("window.location='/logout.php';", 600000);
</script>
</head>
<body>

sneakyimp

thanks very much!