Practice
To change the session lifetime, you'll need to perform a series of steps:
1) It's just the structure of PHP that, to change the session lifetime, you'll have to create a separate directory for these sessions. For example, you want the lifetime to be the same across the whole site. Then create a directory inside this site where sessions will be stored.
The thing is that by default the PHP interpreter uses the same directory to store sessions for all sites. Because of this, if one site has a shorter lifetime set than the others, the "garbage collector" script of this "short-lived" site will clean up not only its own files but all session files whose last update time hasn't changed for longer than this particular site's session lifetime. So, if we have 3 sites with session lifetimes of, respectively, 30, 60, and 120 minutes, then the session lifetime for ALL sites will end up being 30 minutes. That's how the garbage collector works — it doesn't distinguish whether a session belongs to this site or someone else's.
For example, we have a site located at /www/mysite.ru.
Let's create a directory for sessions inside it
Here, instead of www-data, use the username and password under which Apache runs (you can find these out from the Apache config, or from the output of the ps command).
The directory we created is readable and writable only by the web server's user, which rules out its unauthorized use from the outside.
2) In the PHP files, before session_start(), you need to insert the following lines:
Here, 86400 is the session lifetime in seconds.
Why through PHP, and not through "php_value" in .htaccess? Because here it's convenient for us to use the $_SERVER['DOCUMENT_ROOT'] variable, thus not tying ourselves to a specific directory relative to the server's file system.
The first and second lines can be written in .htaccess, however I don't see the point in spreading them across two different files.
3) The garbage collector is a script that runs with a certain probability when a page is opened. The thing is, it doesn't run with 100% probability, in order to reduce the load on the server. By default this is 1%. So, only in 1% of cases when a page is opened will the session's validity be checked (i.e., "whether it has expired").
You're surely not satisfied with such a low frequency. So let's change this parameter. The following parameter controls the probability of checking sessions when a page is opened:
session.gc_probability can take values from 1 to 100 — respectively, from 1% to 100%. If you set 100, the garbage collector will run every time, on every page opened by users. This will increase the load on the server, but this way you guarantee that the session won't live longer than the lifetime you've specified.
Setting this value is a matter of analysis and calculation. If the site has a lot of visitors, values above 30% will not only create excessive load, but will also bring no benefit — after all, what's being counted are page loads not of this particular session, but of all page loads in general. If only a few people visit the site (for example, some internal company site), then the probability can be set higher.
4) To do a final check, run
and see whether the time has changed
Comments