Re: When to destroy sessions that iterate
| From: | Richard Lynch | Date: | Fri, 26 Jul 2002 16:24:24 +0000 |
| Subject: | Re: When to destroy sessions that iterate | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-109801@lists.php.net to get a copy of this message | ||
>Prolly a silly question, but I have a session process that never really
>ends as it is supposed to allow the user to carry on submitting etc.
>
>So I don't know where and when to end the session, and if it is really
>nescessary to end a session?
>
>Obviously a logout button will do the trick, but what about aborting
>users that don't bother to logout? I presume a session will have a
>timeout value? If so, how does this work? Surely there can't be a
>physical time allowed for a session to stay alive? What about if I want
>to have an intranet application that could ( and preferably should) be
>able to be open indefinately?
It's up to you when to destroy a session.
You can alter the global time out in php.ini, and/or you could update a time
stamp on every action in your session data, and if they haven't done
anything in a longer time frame than you consider "right", just destroy
their session and make them start over.
Keep in mind that for sensitive data, it's all too easy for a user's machine
to be used while they are on a coffee-break, so long-lived sessions would
not be suitable.
Also, even for public data, users have a nasty habit of forgetting their
passwords that you don't make them actually use for a long time, and then
you have the joy of pointing them to the "forgot" page to re-issue via email
(which is also not suitable for sensitive data) because many will *NOT*
think to just try to log in and get re-directed there, much less go looking
for it on purpose. Oh no, it's much easier to call you up and ask what
their password is, no matter how many times you tell them that it just
doesn't work like that, and you don't *know* their password... Sigh.
--
Like Music? http://l-i-e.com/artists.htm
I'm looking for a PRO QUALITY two-input sound card supported by Linux (any
major distro). Need to record live events (mixed already) to stereo
CD-quality. Soundcard Recommendations?
Software to handle the recording? Don't need fancy mixer stuff. Zero (0)
post-production time. Just raw PCM/WAV/AIFF 16+ bit, 44.1KHz, Stereo
audio-to-disk.