Limiting Session Length in-page

[kyleldi]

I'd like to limit the session length on one specific page on this site i'm working with.  I've done the following code, but it doesn't matter if I set it to 5 or 1500, the page will not time-out on refresh.  Any ideas how I can make this work?  I'd like the session to only last like two minutes, so if the person calls the same page up again it will tell them to go back to the main page and start over.

 

<?php
ini_set('session.gc_maxlifetime', 5); 
session_start();
?>

[PFMaBiSmAd]

That's because session garbage collection is only intended to be used to delete old session data files, not to end sessions or to log someone out. Garbage collection runs randomly, so session data files could randomly exist for a long time on a server with few session_start() statements being executed.

 

The session settings like session.gc_maxlifetime are global among all your scripts and if you are on a shared web server using the default tmp session save path, they are global among all the scripts of all the accounts running on the server. To have different values on different pages would require you to also set the session save path to different folders for those pages, but this would also mean that the session data used on one page would not be present on another page. If you logged in one one page and then went to a page using a different session save path, you would need to log in again.

 

Folks, a session is just a 'container' that allows variables to exist between page requests. Don't rely on the underlying operation of a session to accomplish anything in your application, like log someone out. If you want to do something specific in your application, like have a shorter automatic log out on a page, you will need to store a value in your session that indicates the last access time on that page and then check on the next page request if that last access time is farther in the past than a limit you pick and take appropriate action in your code.