session help

[mworkman]

I am trying to get sessions to work right

Here are my settings:

session.gc_maxlifetime = 60

session.gc_probability = 1

session.gc_divisor = 1

session.cookie_lifetime = 0  (when browser closes)

 

So say I have two php files:

php1.php

session_start();
$_SESSION['var1'] = 'var1';

 

php2.php

session_start();
echo $_SESSION['var1']. '<br>';

 

So if I go to php1 it will set the variable and then I can go to php2 and it will echo the variable.  This works.  But if I don't do anything and then go back to php2 after 60 seconds the variable should no longer exist.  This part is not working.  What do I need to change to get it to work?

[PFMaBiSmAd]

The access time of the current session data file is refreshed on the session_start() statement and garbage collection won't delete the session data file of the session that caused garbage collection to run.

 

You should not rely on the underlying operation of session garbage collection to DO anything, like log people out. You should handle operations like that in your application code.

[mworkman]

I'm not sure I understand.  How would I change the code so the variable would no longer exist after 60 seconds?

[revraz]

Change

session.gc_maxlifetime = 60

to a higher value

[mworkman]

Change

session.gc_maxlifetime = 60

to a higher value

 

Wouldn't that do the opposite.  The problem is the variable is staying after 60 seconds, not that it is disappearing after 60 seconds.

[noXstyle]

heh. the dude is lost.

 

but anyhow.. what PFMaBiSmAd prolly told you is to check if the session has expired and then to unset your var.. you can get the session lifetime using func session_cache_expire...

 

the problem could also occur from cache. setting  session.cookie_lifetime to same as your session could prolly help... try to run it with your cache disabled so you can sort out wether it is a cache related problem or not.

[revraz]

I see what you mean, I misread your initial post.  As stated, don't rely on the GC to remove your sessions because it's a Probability, which is not a reliable method.

 

Granted, your 1/1 should mean that it cleans it up everytime, but it should not be relied upon to do so.

 

 

 

http://php.net/manual/en/session.configuration.php

[mworkman]

anyone know a good tutorial making code for handling logging people in and out?

[revraz]

You can write a timestamp to a database and have a field set for logged in or logged out, and change it after so many minutes.

[PFMaBiSmAd]

The evolt tutorial is fairly popular - http://www.evolt.org/PHP-Login-System-with-Admin-Features