[Resolved] Session Questions

fean0r

Hi,

I was hoping you could help me with a few questions I have on sessions.

How long will a session last if a user leaves my site without using logout?
If 2 people are on a shared network will they somehow share the same session?
Can a user alter a session client side?

Thanks

devinemke

that depends on the session.gc_maxlifetime directive in your php.ini. the default is 1440, meaning if there is no session activity for 1440 seconds then the session will be flagged as garbage and will be eventually deleted.
no
sessions are stored on the server, not on the client, so a client cannot alter a session other then by the means you (the programmer) have allowed them to. the means by which a client is mapped to a session is on the client (usually by using cookies) and therefore it is possible for one client to hijack another client's session.

czambran

With regard to the first question. I think that depends. I use php with Windows and session.gc_maxlifetime = 0(This came by default). This means that the sessions does not expire until you close your browser.

fean0r

Thanks guys - I'm getting a strange error on my code the session is somehow picking up a userid that I deleted ages ago.... back to bug tacking lol

fean0r

I'm still getting an error.

<?
session_start();
header("Cache-control: private");
print_r($_SESSION);
?>

I use this to carry all my sessions from page to page, it seems to work except for 1 thing.

When I login I get this

Array ( [userid] => 21[userlevel] => 1 [theme] => c4-blue [username] => test [cs] => No )

If I refresh the page or move to any other link i get this

Array ( [userid] => 9 [userlevel] => 1 [theme] => c4-blue [username] => test [cs] => No )

The one thing that changes is the [userid], any ideas?

fean0r

got sorted - found the bug

czambran

Could u please tell me what was the bug?

fean0r

I was was setting $userid in one of my pages, which changed my $_session['userid'] - The 2 pieces of code weren't related.