PHP Session management
I have built a user login system.
Problem is when i close the window leave my application for a day or two and come back i am still logged in.
How can i detect if the window has been closed so i can kill the session?
Killing the session ican just do:
unset($_SESSION['sessionName']);
session_destroy($_SESSIOm['sessionName']);
decibel.places posted this at 21:21 — 24th November 2008.
He has: 1,494 posts
Joined: Jun 2008
You probably should give the SESSION a duration.
Usually I let Drupal handle this, there is an autologout module, not sure how it works.
You could set a database timestamp, or perhaps a SESSION variable, and renew it with activity, or kill the session after a specified elapsed time...
Check out these search results
benf posted this at 12:54 — 25th November 2008.
They have: 426 posts
Joined: Feb 2005
Yes and also, i have now transfered my preject to a test directory on my server. Rahter than expecting no user to be logged in there is a user logged in.
It seems my session management is not quite right.
My authentication stores the session variable generated after login in the database, then i have a auth function that checks the session in the database against the session variable.
I thought the session expires after 20 mins by default?
Why would i still be logged in after a few days and after transfering my site over to a different server.
Good Value Professional VPS Hosting
greg posted this at 03:33 — 26th November 2008.
He has: 1,581 posts
Joined: Nov 2005
Remember $_SESSION uses COOKIES by default, so it might be a case that the session is being set to a cookie in your browser/pc and not being deleted
benf posted this at 11:27 — 26th November 2008.
They have: 426 posts
Joined: Feb 2005
I did not know that - your saying that any session set will also be set as a cookie by default?
This must be a php setting then?
Or i must unset and destroy all cookies with the same name.
Good Value Professional VPS Hosting
greg posted this at 15:43 — 26th November 2008.
He has: 1,581 posts
Joined: Nov 2005
you can try it yourself
set data to a session, goto another page and see if the session isset and has data
then unset the session, turn off your cookies in the browser and try it again
when you call "session_start()" (as i presume you are) php sets SID (session ID) and is default set in a cookie
It can be accessed by using that ID in URLS, but now we are getting into issues with SEO and security issues.
also, have a read of this if you haven't already
http://uk2.php.net/session
its technical rather than informative, but is worth reading through the functions you are using as it has some must read warnings
(i.e. "Do NOT unset the whole $_SESSION with unset($_SESSION) as this will disable the registering of session variables through the $_SESSION superglobal.")
Want to join the discussion? Create an account or log in if you already have one. Joining is fast, free and painless! We’ll even whisk you back here when you’ve finished.