Re: Session Timeout

Hi, Saturday, August 30, 2003, 1:55:02 PM, you wrote: SW> From what I see, the default timeout for a session is 1440 seconds or SW> 24 minutes. I was gone for nearly an hour, came back, and the session SW> was still valid. Must the value set in the config file be different SW> than 1440, or am I misunderstanding session.gc_maxlifetime? I'd like SW> for the user to be required to log in if they've been inactive for 10 SW> minutes, or if they closed the browser window and opened another one. SW> Sorry for all the basic questions :) SW> Seth Willits SW> ------------------------------------------------------------------------ SW> --- SW> President and Head Developer of Freak Software -
\X»º SW> cwY‚ŽK¾¢http://www.freaksw.com SW> Q&A Columnist for REALbasic Developer Magazine - SW> http://www.rbdeveloper.com SW> Webmaster for REALbasic Game Central - SW> http://www.freaksw.com/rbgames SW> "Not everything that can be counted counts, and not everything that SW> counts SW> can be counted." SW> -- Albert Einstein SW> ------------------------------------------------------------------------ SW> --- The session timeout just sets the maximum time before the session data becomes valid for a garbage collect. If a garbage collect is not triggered the data is still valid as far as php is concerned. You have to implement your own timeout checks if you need exactly 24 minutes. You can do this by storeing the last accessed time in the $_SESSION array and check it on each start. I think by default garbage is collected 1 in every 100 hits. (1%) If it done on every hit it would start to impact performance on busy sites. -- regards, Tom