The Definitive Way To Control Session TimeoutSince the beginning of session handling on PHP, people have tried to figure out how to control the lifetime of the _SESSION variable.
Here is the answer.
ini_set('session.save_path', /var/my-sessions-dir/);
ini_set('session.cookie_lifetime', 2592000);
Insert this code before you call session_start();
Without getting into a lengthy discussion about cookie lifetime and PHP garbage collection algorithms, here is a short explanation about what is going on.
The most important line here is the first.
In order to get complete control over how long session information is stored, you must store your session files in a unique location so they are not shared with other applications. This ensures that PHP's garbage collection mechanism will not delete your session files because someone else's application wants it to. This is especially true on a shared server.
It's best to keep your session files out of the web space (not accessible to the web server) so people cannot view them in a browser by correctly guessing a session ID.
Now that the files are in a directory unique to your application, there are 2 more things to do:
(1) Keep session cookies around for a long time, and
(2) Clean up our session files from time to time.
The second line tells PHP how long to let the cookie live, in seconds. The example above shows 30 days, but it's up to you what value you use.
Now there's just 1 problem remaining to solve.
PHP will never garbage-collect (delete) your session files.
The PHP.ini file documentation says this:
If you are using the subdirectory option for storing session files (see session.save_path above), then garbage collection does *not* happen automatically. You will need to do your own garbage collection through a shell script, cron entry, or some other method. For example, the following script would is the equivalent of setting session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes)
cd /path/to/sessions; find -cmin +24 | xargs rm
In short, this means that once you set the
ini_set('session.save_path', /var/my-sessions-dir/);
directive, your session files will never be erased.
Since you don't want your session files accumulating forever, you need a mechanism built in to your application to delete them on a regular basis.
Here's the solution:
$dir = '/path/to/sessions/dir/';
if (rand(1, 100) == 1) {
if ($handle = opendir($dir)) {
while (false !== ($file = readdir($handle))) {
if ($file[0] == '.' || is_dir($dir.$file)) continue;
if ((time() - filemtime($dir.$file)) > (2592000)) unlink($dir.$file);
}
closedir($handle);
}
}
Just update 2592000 to be the actual number of seconds you want your sessions to live.
Insert this code before you call session_start();
You don't need your garbage-collection code to run every time your app runs, so we need a probabilistic-conditional (code that only runs occasionally). This is what the rand() statement does.
In the case of the code above, it only runs 1 time out of every 100 times (on average). If you want to make it run, let's say, 1 time out of every 10, just change the 100 to 10.
Hope this helps someone out there.
