How to set maximum life of the session to be 5 sec in PHP

Question

we have set session_gcmaxlife=5 in php.ini but session variable on server are not destroyed after 5 seconds

We want to set the maximum life of the session in PHP to be 5 seconds.

Answer 1

In general you can say session.gc_maxlifetime specifies the maximum lifetime since the last change of your session data (not the last time session_start was called!). But PHP’s session handling is a little bit more complicated.

Because the session data is removed by a garbage collector that is only called by session_start with a probability of session.gc_probability devided by session.gc_divisor. The default values are 1 and 100, so the garbage collector is only started in only 1% of all session_start calls. That means even if the the session is already timed out in theory (the session data had been changed more than session.gc_maxlifetime seconds ago), the session data can be used longer than that.

Because of that fact I recommend you to implement your own session timeout mechanism. See my answer to How do I expire a PHP session after 30 minutes? for more details.

Quote: How long will my session last?

The best solution is to implement your own timeout mechanism. It's simple.

$_SESSION['created'] = time();

Now you only need to have a if statement to check whenever the 5 seconds have passed and when it does, destroy the session data.

if (time() - $_SESSION['created'] > 5) {
    session_destroy();
    session_unset();
}

Answer 2

You can use the setcookie() function. It takes a parameter for time out.

$timeout = 5; // 5 seconds 
if (isset($_COOKIE[session_name()])){
    setcookie(session_name(), $_COOKIE[session_name()], time() + $timeout, "/");
}

then you can use cookie manager+ in firefox to see if the session is destroyed.

source

Answer 3

OK - to me a 5 second session sounds rather pointless (as a session is supposed to maintain the application state in a stateless application... yeah).

Your best bet is to probably save an expiry timestamp (time() + 5 seconds) in the session, something like $_SESSION['expires'] - then whenever you start a session, check to see if that variable exists and, if so (and is in the past), kill the session off and start again.

---

[EDIT]

This is one other possibility that might work, but you'd need to create an object to manage your session - then you could have a kill() method that could be invoked if the session has expired and in the __destruct() method - it's not fullproof as the destructor will only be invoked when the object is destroyed - but it should work.

class Session {

  private static $_instance;

  //private constructor to prevent external instantiation
  private function __construct($sSessName, $sSavePath, $iGCLifetime, $sCookieDomain, $sCookiePath) {

    //session parameters
    ini_set("session.save_path", $sSavePath);
    ini_set("session.gc_maxlifetime", $iGCLifetime);
    ini_set("session.use_trans_sid", false);

    //session cookie parameters
    ini_set("session.use_cookies", true);
    ini_set("session.use_only_cookies", true);
    ini_set("session.cookie_domain", $sCookieDomain);
    ini_set("session.cookie_path", $sCookiePath);
    ini_set("session.cookie_lifetime", 0);

    //set the session name
    session_name($sSessName);

    //set the session cookie paramaters
    session_set_cookie_params(0, $sCookiePath, $sCookieDomain);

    //start the session
    session_start();

    //check to see if the session has expired - and if so kill it
    if(isset($_SESSION['expires']) && time() > $_SESSION['expires']) {
      $this->kill();
    }

    //if not - set the expiry time in the session
    else {
      $_SESSION['expires'] = time() + 5;
    }
  }

  //destructor function _should_ kill the $_SESSION when the object is destroyed
  public function __destruct() {
    $this->kill();
  }

  //session killer
  public function kill() {
    //kill the session cookie
    setcookie(session_name(), null, time()-3600);

    //kill the session
    session_unset();
    session_destroy();
  }

  //Singleton instance getter
  public function getInstance() {
    if(!self::$_instance) self::$_instance = new self();
    return self::$_instance;
  }
}

Answer 4

Include a timestamp attribute of the $_SESSION variable. Check it periodically and expire the session according to a conditional:

$_SESSION['mytimestamp'] = time();