[SOLVED] Making Sessions Last Forever?

[Xyphon]

Question... I am switching from cookies over to sessions, for security reasons.. And well, my biggest problem is, cookies you can set the time and make them last months-years, basically as long as you want..

 

But how do you make sessions last forever? Thanks in advance.

[abdfahim]

You might want to check session.gc_maxlifetime

[Xyphon]

I can't set it from there, I don't own the server. I'm on a host.

[abdfahim]

please check whether you can set this variable using ini_set function ... with ini_set, you can set some of the environment variables from your host page (for that page only).

[Xyphon]

Would I put it at the top of every page or what?

[abdfahim]

yup ... like

if(!ini_set("session.gc_maxlifetime", "24000")){ //24000 sec long
      throw new Exception("Failed to set execution time");
}

 

I am again emphasizing the fact that just do a simple google search on session.gc_maxlifetime to make sure whether ini_set support session.gc_maxlifetime

[Xyphon]

I didn't receive an error but I set it to 1 second, went on, and then the session never expired in 30 seconds.

[PFMaBiSmAd]

That's because the only purpose of the session garbage collection is to delete old session data files. It is not intended to end sessions or log someone out. It runs randomly, so session data files can exist for any random amount of time past the session.gc_maxlifetime value.

[Xyphon]

Then how do I make it so that the session ends once the session.gc_maxlifetime ends, so I can test of my ini_set worked?

[Xyphon]

Bump

[ldougherty]

I just found this, may be useful for you..

 

http://us2.php.net/manual/en/function.session-cache-expire.php

 

Hello,

Some of my customers asked me for a solution form their session not to expire when filling large forms. Sometimes it takes them more than 2 hours to submit (phone, desk customers...).

I know I could have forced an ilayer to be refreshed dynamically and then include PHP code using session_cache_expire() function, but this refreshing a page changes the form focus. So I found this the only solution for them not to loose focus over their form element.

 

You can make a session not to expire by using this code.

Its a mixture of PHP and JavaScript and can be used on the same page were your code goes or it can be called using an ilayer/iframe from your page.

 

I know this is not the best practice, but in some cases were user has no control over server globals and security is not important this can help.

 

Here is the code.

 

<?

//First of all we prevent browsers from caching the image
header("Cache-Control: no-store, no-cache, must-revalidate");
header("Cache-Control: post-check=0, pre-check=0", false);
header("Pragma: no-cache");
header("Expires: Mon, 26 Jul 1997 05:00:00 GMT");
header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT");

//This piece of code returns a blank gif
if($_GET[img] > 0){
    header('Content-Type: image/gif');
    header("Content-Disposition: inline; filename=".time().".gif");
    echo base64_decode(str_replace("\n","","
R0lGODlhAQABAPcAAAAAAAAAQAAAgAAA/
wAgAAAgQAAggAAg/wBAAABAQABAgABA/
wBgAABgQABggABg/wCAAACAQACAgACA/
wCgAACgQACggACg/wDAAADAQADAgADA/
wD/AAD/QAD/gAD//yAAACAAQCAAgCAA/
yAgACAgQCAggCAg/yBAACBAQCBAgCBA/
yBgACBgQCBggCBg/yCAACCAQCCAgCCA/
yCgACCgQCCggCCg/yDAACDAQCDAgCDA/
yD/ACD/QCD/gCD//0AAAEAAQEAAgEAA/
0AgAEAgQEAggEAg/0BAAEBAQEBAgEBA/
0BgAEBgQEBggEBg/0CAAECAQECAgECA/
0CgAECgQECggECg/0DAAEDAQEDAgEDA/
0D/AED/QED/gED//2AAAGAAQGAAgGAA/
2AgAGAgQGAggGAg/2BAAGBAQGBAgGBA/
2BgAGBgQGBggGBg/2CAAGCAQGCAgGCA/
2CgAGCgQGCggGCg/2DAAGDAQGDAgGDA/
2D/AGD/QGD/gGD//4AAAIAAQIAAgIAA/
4AgAIAgQIAggIAg/4BAAIBAQIBAgIBA/
4BgAIBgQIBggIBg/4CAAICAQICAgICA/
4CgAICgQICggICg/4DAAIDAQIDAgIDA/
4D/AID/QID/gID//6AAAKAAQKAAgKAA/
6AgAKAgQKAggKAg/6BAAKBAQKBAgKBA/
6BgAKBgQKBggKBg/6CAAKCAQKCAgKCA/
6CgAKCgQKCggKCg/6DAAKDAQKDAgKDA/
6D/AKD/QKD/gKD//8AAAMAAQMAAgMAA/
8AgAMAgQMAggMAg/8BAAMBAQMBAgMBA/
8BgAMBgQMBggMBg/8CAAMCAQMCAgMCA/
8CgAMCgQMCggMCg/8DAAMDAQMDAgMDA/
8D/AMD/QMD/gMD///8AAP8AQP8AgP8A/
/8gAP8gQP8ggP8g//9AAP9AQP9AgP9A/
/9gAP9gQP9ggP9g//+AAP+AQP+AgP+A/
/+gAP+gQP+ggP+g///AAP/AQP/AgP/A/
///AP//QP//gP///yH5BAEAAP8ALAAAA
AABAAEAAAgEAP8FBAA7"));
    exit;
}

?>

<!-- HERE YOU CAN INSERT THE HTML OR PHP CODE -->

<img name="keepUpdated" src="<?=$_SELF?>?img=999">
<script language="Javascript">
<!--
var updateEvery = 30;//Seconds
function keepUpdated() {
    timer=setTimeout("updateImage()",1000*updateEvery)
}
function updateImage() {
    var randNum = Math.floor(Math.random()*999);
    document.images.keepUpdated.src ="<?=$_SELF?>?img="+randNum;
    keepUpdated();
}
keepUpdated();
//-->
</script>

 

I hope this can be helpful for someone.

 

Bermi Ferrer

[Xyphon]

@Idougherty: That code is a little.. Confusing.. for me..

[cunoodle2]

Why do you think that cookies are less secure?  Is it because people can change the info in them?  Maybe you should should look at the way that you are encrypting the info in the cookies themselves.  That or use sessions with cookies together.  If the server is somehow root hacked people will be able to see your session variables anyway.  Being that you are on a shared server there is always a possibility of that happening.

 

My 2 cents

 

[Xyphon]

I got it all to work guys. Thanks!