note 28737 added to ref.session

Since session.gc_maxlifetime and the general gc are somewhat broken on different platforms (including Linux), it's simpler/better/faster to write your own expiration code. define(EXPIREINSECONDS, 15 * 60); // 15 minutes if (isset($_SESSION['timestamp']) && (date('U') - $_SESSION['timestamp']) > EXPIREINSECONDS) session_destroy(); else $_SESSION['timestamp'] = date('U'); Simple enough? ;) Note that it's better to write a logout() function and destroy all session data manually before calling session_destroy() - for example, if running in non-cookied mode session data is not destroyed for the lifetime of the script instance calling session_destroy(), only for subsequent calls. -- http://www.php.net/manual/en/ref.session.php http://master.php.net/manage/user-notes.php?action=edit+28737 http://master.php.net/manage/user-notes.php?action=delete+28737 http://master.php.net/manage/user-notes.php?action=reject+28737