[RESOLVED] Sessions spontaeously "ending"/users getting kicked off

[bunner_bob]

I'm working on a custom CMS that includes a login section for administering the site. A successful login sets a couple of session vars (userId and accessLevel) that are then checked on each subsequent admin page load. I don't seem to run into this myself but my clients tell me they are getting kicked off periodically and having to log back in again. In some cases this appears to be after some inactivity; in others they may have been active (sorry, need to dig deeper on this with my clients).

I'm not explicitly setting any kind of timer or limit on the login - so any ideas what could be causing this? The sites in question are all hosted on Pair Networks, if that makes any difference.

I'd post code but it's really as simple as what I outline above - set a couple of session vars, check them on each page load. Guess I'm just wondering if anyone has any insights in general regarding sessions ending when not explicitly asked to do so. Then I can figure out what kinds of tests to set up to learn more.

Thanks!

Bob

[bunner_bob]

Also wanted to add - my clients are typically on PCs (IE and Firefox), I'm on a Mac. Could there be something on the PC or browser that's involved?

[dalecosp]

Doubt that it's the case, but have you checked session_save_path in php.ini ... and asked the hosts if, perhaps, they nuke /tmp periodically?

[dalecosp]

And yes, it could be them, particularly if they have cookie controls/some sort of privacy settings on the browser.

[bunner_bob]

Good advice on the /tmp directory - I set up my own directory and accompanying PHP save path and it seems to have improved things. However, I'm still hearing reports of users getting logged off at seemingly random intervals.

Could it be garbage collection? I read (somewhere) that garbage collection works on some kind of "probability" basis - meaning, I guess, that at any moment it might or might not decide to kill a session. It didn't seem like gc paid any attention to how long since the session was last accessed. But that seems crazy - perhaps I misread.

I know when creating a cookie one sets the expiration, but I'm not aware of a similar process when using session_start.

Sorry for being dense - sessions behavior is a little black-boxy to me, at least compared to most of what PHP does.

• Bob

[Derokorian]

cookie time can be set in the php.ini file via the session.cookie_lifetime # directive. By default this is sset to 0 meaning until the browser is closed.

[bradgrafelman]

bunner bob;10985091 wrote:

I read (somewhere) that garbage collection works on some kind of "probability" basis - meaning, I guess, that at any moment it might or might not decide to kill a session.

Indeed - PHP essentially flips a coin (or, rather, rolls an N-sided die) to decide if it should execute its GC routine. Relevant PHP directives there are: session.gc_probability and session.gc_divisor.

bunner bob;10985091 wrote:

It didn't seem like gc paid any attention to how long since the session was last accessed.

Ah, but it does; take a look at the session.gc_maxlifetime PHP directive.

[bunner_bob]

Looks like session.gc_maxlifetime was the solution after all. Apparently the host was pretty aggressive about killing sessions that exceeded the lifetime. We upped it to an hour and have heard few complaints. Thanks!