Re: session timeout

Philip Thompson wrote:

Hi all. I have users log into my site to perform certain actions. However, I want to create a timed session so that it automatically logs them out after a certain amount of time. I am using session_set_cookie_params() to create the amount of available time that the user is logged in.

Cookies are not reliable, as they are client side. One can easily extend this period to infinity. You should instead store the login time in a session variable and check this variable on each request.