keep php sessions going until web browser closed

[arianhojat]

i know with cookies you can set it so when user closes browser, the cookie is deleted.

 

but since sessions can use either url or cookies, how do you set tackle that?

how would you set the time the session is kept alive?

 

i think if your session just uses cookies then you would set session.cookie_lifetime to 0.

session.cookie_lifetime  integer

    session.cookie_lifetime specifies the lifetime of the cookie in seconds which is sent to the browser. The value 0 means "until the browser is closed." Defaults to 0. See also session_get_cookie_params() and session_set_cookie_params(). Since the cookie is returned by the browser, it is not prolonged to suffice the lifetime. It must be sent manually by setcookie().

 

 

[arianhojat]

bump

[Lytheum]

I thought sessions automatically existed until you either close your browser or destroy them. I'm probably wrong, maybe someone can clear this up. Would be interesting

[rcorlew]

Sessions exist 3 ways depending on php version.

 

1. Browser open(IE saves sesions across all open windows, be careful)

 

2. Until they are unset and destroyed

 

3. Some session could remain active on server after browser window closes on some php configurations/version. It is good practice to set up a CRON jobe to clean up all temp sessions at least once a week, you could also do this in the script itself to tell php to check for dead sessions and clean them up.

[Jenk]

All sessions remain active until timeout, or a call to session_destroy().

 

It is impossible to reliably have the users browser trigger a session_destroy() as the browser is closed.

[arianhojat]

how does myspace do it?

 

u log in and the session starts when u login,

i never hit logout, yet when i close browser window and come back later 1 hr later, i have to retype password.

i dunno how session gets destroyed without them calling a session_destroy-like fucntion since no user interaction occurs like a logout button.

 

and for a site like that it makes sense however they do it, cause people sign in from school/work/public omputers and dont want session to remain so another user can goto myspace.com and change users settings.

[rcorlew]

they are more than likely using cookies then that have an expirey of 0, or if they are using $_SESSION, they have problably told the script(s) to  go a clean up every time they are ran with gc_probability() to do that.