Req #68127 [Opn]: Very short maxlifetime in default php.ini

Edit report at https://bugs.php.net/bug.php?id=68127&edit=1 ID: 68127 Updated by: yohgaki@php.net Reported by: atze_80 at web dot de Summary: Very short maxlifetime in default php.ini Status: Open Type: Feature/Change Request Package: *Configuration Issues PHP Version: 5.6.0 Block user comment: N Private report: N New Comment: 1440 seconds may be too short for many sites. However, if session.gc_maxlifetime should have larger value, users should set larger value manually. Default values should be safe enough values. IMHO. There are too many sites that do not use SSL currently. If vast majority of PHP sites use SSL, then we may consider to use larger value for session.gc_maxlifetime. Even if this became the case, 3600 seconds would be long enough. IMO. Previous Comments: ------------------------------------------------------------------------ [2014-10-03 10:05:39] tyrael@php.net hi, the default value for this setting is the same since session gc was introduced back in '99. maybe it would be appropriate to change the defaults (which should also include changing the hard coded default when no ini is present: http://lxr.php.net/xref/PHP_5_5/ext/session/session.c#790) but I think this would be better discussed on the mailing list, and having an RFC for changing this would be also reasonable. ------------------------------------------------------------------------ [2014-10-01 20:59:07] atze_80 at web dot de Description: ------------ In the php.ini delivered with php source is the following setting session.gc_maxlifetime = 1440 according to the documentation this value is in seconds, which means that the default session lifetime is just 24 minutes. I cannot help myself but assume that there is a missing zero. A value of 14400 seconds is 4 hours which is more reasonable. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=68127&edit=1