Session data-files not removed?

From: Date: Wed, 07 May 2003 08:04:25 +0000
Subject: Session data-files not removed?
Groups: php.general 
Request: Send a blank email to php-general+get-146627@lists.php.net to get a copy of this message
Now i'm a little confused. I made a script, which starts with session_start(); and shows the session_id(); on the page and gives you a form to input something in a text field which will be stored in the session ($_SESSION['name']=$_POST['name']). Then, i copied the session id displayed on the page, to the url-field (for example /index.php?PHPSESSID=63et3e9g9dg2d90gd82dg8) and this works, even when i close the browser, start a new browser and go directly to that url with PHPSESSID. The session-data with it's name var still exists. Browser closed, 12 hours later i call that page with that PHPSESSID again and the session-data still exists. (BTW, it's PHP4.1.1 on PWS ON NT4) (THE QUESTION) This way, the server keeps storing all the session data-files and never removes them!?!?!? Here's the most important code of php.ini.. [Session] ; Handler used to store/retrieve data. session.save_handler = files ; Whether to use cookies. session.use_cookies = 1 ; Name of the session (used as cookie name). session.name = PHPSESSID ; Initialize session on request startup. session.auto_start = 0 ; Lifetime in seconds of cookie or, if 0, until browser is restarted. session.cookie_lifetime = 0 ; Handler used to serialize data. php is the standard serializer of PHP. session.serialize_handler = php ; Percentual probability that the 'garbage collection' process is started ; on every session initialization. session.gc_probability = 1 ; After this number of seconds, stored data will be seen as 'garbage' and ; cleaned up by the garbage collection process. session.gc_maxlifetime = 1440 ; Check HTTP Referer to invalidate externally stored URLs containing ids. ; HTTP_REFERER has to contain this substring for the session to be ; considered as valid. session.referer_check = ; How many bytes to read from the file. session.entropy_length = 0 ; Specified here to create the session id. session.entropy_file = ;session.entropy_length = 16 ;session.entropy_file = /dev/urandom ; Set to {nocache,private,public} to determine HTTP caching aspects. session.cache_limiter = nocache ; Document expires after n minutes. session.cache_expire = 180 ; trans sid support is disabled by default. ; Use of trans sid may risk your users security. It may not be ; feasible to use this option for some sites. Use this option with caution. session.use_trans_sid = 0 Is there an advisable way to write code so this doesn't happen, or do i really need to make some changes to php.ini for that.. or what? Thanks, M. Vek

« previous php.general (#146627) next »