setting session to expire

[turtleman8605]

What's the best way to set a session to expire after a set amount of time?

[akitchin]

you could do this either manually, or using the server settings.  using the server settings is merely a matter of changing the php.ini setting regarding session lifetimes.  the other method would involve setting a timestamp in the session, and check that against a certain time interval.  if it's older, unset() the session and they're forced to re-create it (by whatever means you're providing, for example, logging in):

 

if (isset($_SESSION['timestamp']))
{
  if (time() - $_SESSION['timestamp'] >= 180)
  {
    unset($_SESSION);
  }
  else
  {
    $_SESSION['timestamp'] = time();
  }
}
else
{
  $_SESSION['timestamp'] = time();
}

 

this will unset the session if the timestamp is set, and the timestamp is 180 or more seconds old (ie. 3 minutes; timestamps are in seconds).  otherwise, it'll renew the timestamp so that they can begin or continue their session.  you can probably toss this into a function and just call it on every page.

[turtleman8605]

so, could I just set a manual timestamp, maybe in a hidden form field when they log in?

[akitchin]

you don't even need to make it a hidden form field - just generate it afresh when they login.  assuming you're storing their username and password in the session, just add a $_SESSION variable for the time, and assign it a value of time().  then use the code i gave you (or come up with your own around the same principle) to track whether it should be manually expired or not.