How to Reliably Manage PHP Session Expiry After 30 Minutes?

How to Manage PHP Session Expiry after 30 Minutes

The need for maintaining a session alive for a specific time and then terminating it is common in web development. PHP provides options for setting session timeouts, but they may not always yield reliable results. Let's understand the shortcomings of existing PHP mechanisms and explore a reliable solution.

Reliability Issues of PHP's Built-in Timeout Options

PHP offers two options for setting session timeouts:

1. session.gc_maxlifetime: Controls the number of seconds after which PHP considers session data as "garbage" and initiates cleaning. However, this option is not reliable because the garbage collection process depends on a random probability determined by session.gc_probability and session.gc_divisor.
2. session.cookie_lifetime: Specifies the lifespan of the cookie sent to the browser. However, this option merely impacts the cookie's duration and does not invalidate the session itself.

Implementing a Custom Session Timeout Mechanism

To establish a reliable session timeout, implement your own solution. This can be achieved by maintaining a time stamp representing the last user activity.

if (isset($_SESSION['LAST_ACTIVITY']) && (time() - $_SESSION['LAST_ACTIVITY'] > 1800)) {
    // Last request was more than 30 minutes ago
    session_unset(); // Unset $_SESSION variable
    session_destroy(); // Destroy session data in storage
}
$_SESSION['LAST_ACTIVITY'] = time(); // Update last activity timestamp

1. Check if a "LAST_ACTIVITY" key exists in the session and verify if 30 minutes have passed since the last activity.
2. If the session has been inactive for over 30 minutes, unset all the session variables using session_unset() and destroy the session using session_destroy().
3. Regularly update the "LAST_ACTIVITY" timestamp every request to keep the session alive during active use.

As updating session data with each request modifies the session file's modification date, the garbage collector won't prematurely remove the session.

For added security, consider periodically regenerating the session ID to mitigate session hijacking attempts:

if (!isset($_SESSION['CREATED'])) {
    $_SESSION['CREATED'] = time();
} else if (time() - $_SESSION['CREATED'] > 1800) {
    // Session started more than 30 minutes ago
    session_regenerate_id(true); // Change session ID and invalidate old one
    $_SESSION['CREATED'] = time(); // Update creation time
}

Additional Notes

1. Ensure that session.gc_maxlifetime is set to a value greater than or equal to the custom expiration handler duration (1800 in this example).
2. If you seek to expire the session based on 30 minutes of activity, set a cookie expiration using setcookie(..., time() 60*30) to keep the session cookie active.

The above is the detailed content of How to Reliably Manage PHP Session Expiry After 30 Minutes?. For more information, please follow other related articles on the PHP Chinese website!