I have this included at the head of every page in my protected area:
<?php
ini_set('session.cookie_lifetime',60*60);
ini_set('session.gc_maxlifetime', 60*60);
ini_set('session.gc_probability', 100);
ini_set('session.gc_divisor', 100);
session_set_cookie_params(60*60);
session_start();
if (!$_SESSION['valid'])
{
header("Location: login.do");
}
?>
i tested the area after having it sit idle for about 2 hours and what do you know, the session was still valid and I was able to browse around... any ideas?