Re: PEAR::Auth - $expire and $idle, distinction between and recommended settings

On Jun 13, 2004, at 8:55 PM, Michael Ark wrote:

In PEAR::Auth, $expire and $idle default to 0, meaning that sessions never expire. I want to have my sessions expire after about 20 minutes, so I'd like to set these two variables, but I don't really understand the distinction between the two.

"Idle" means that, if between two calls to Auth, more than that amount of time passes, the session terminates. For example, say idle is set to 10 minutes; a user loads a page, authenticates, then waits 11 minutes before loading another page. The idle time has been exceeded, so the user session is terminated by Auth. The "expire" time is the maximum allowed time for a session, regardless of time between page loads. For example, say expire is set to 30 minutes. No matter what the user does, at 31 minutes or later, Auth will terminate his session.

For instance, given these three settings: $a -> setExpire(1200, FALSE) $a -> setIdle(0, FALSE)

An infinite amount of time between page loads is allowed, 1200 seconds are allowed before the session is forcibly terminated.

$a -> setExpire(1200, FALSE) $a -> setIdle(1200, FALSE)

No difference between the two, Auth will terminate the session at 1200 seconds no matter what. Not sure if this counts as an idle or an expire termination, depends on the order Auth checks them.

$a -> setExpire(0, FALSE) $a -> setIdle(1200, FALSE)

The user will never be signed out, unless he waits more than 1200 seconds between page loads.

If my goal is to have a more-or-less 20 minute timeout, what should my settings be for these two things?

You want an expire of 20 minutes, then. Hope this helps. -- Paul M. Jones Savant: the simple alternative to Smarty for PHP. http://phpsavant.com/ DB_Table: build RDBMS tables and XHTML forms in one PHP class. http://wiki.ciaweb.net/yawiki/index.php?area=DB_Table Yawiki: your collaborative online documentation system. http://yawiki.com/ Yawp: a single-file foundation for PHP applications. http://phpyawp.com/