Drupal Session doesn't seem logical

Question

I'm using Drupal 6 for a program that does some e-payment work. Due to the fact that being logged in means that browser can access a users sensitive financial information I want to make sure it will timeout the session after an inactive period.

I tried using:

ini_set('session.cookie_lifetime',  600); //expire after 10 minutes of inactivity

However this logs the user out after 10 minutes regardless of whether they had any activity since login.

Is there a different setting to use or a way to modify this setting to make the session expire after inactivity rather than have a hard and fast lifetime length?

score 0 · Answer 1 · edited May 23 '17 at 12:21

0

You need to implement your own solution there is no reliable way of doing it by just changing settings. If you need more info check out this answer How do I expire a PHP session after 30 minutes?

Taken from top answer in that question:

if (isset($_SESSION['LAST_ACTIVITY']) && (time() - $_SESSION['LAST_ACTIVITY'] > 1800)) {
    // last request was more than 30 minutes ago
    session_unset();     // unset $_SESSION variable for the run-time 
    session_destroy();   // destroy session data in storage
}
$_SESSION['LAST_ACTIVITY'] = time(); // update last activity time stamp

Also you would want to set:

ini_set('session.cookie_lifetime',  0);

So that it never expires on it's own unless they close the browser.

edited May 23 '17 at 12:21

Community

1
1

answered Oct 04 '13 at 21:19

Pitchinnate

7,517
1
20
37

Do `session_unset();` and `session_destroy();` effectively destroy a Drupal session? – BlargleMonster Oct 04 '13 at 21:33
Yes it destroys the php session. – Pitchinnate Oct 04 '13 at 21:35

score 0 · Accepted Answer · answered Oct 04 '13 at 21:34

0

Drupal lets users to stay logged in until they log out. This may not seem logical to you, but it makes a lot of sense to people writing large posts, or willing to resume writing after a pause: they may get disappointed, if after a long day's work they submit their post and get an error because their session has expired.

That said, you may review the Automated logout module, which seems likely to help you with your application's requirements.

answered Oct 04 '13 at 21:34

pamatt

892
10
13

I know my title isn't the best. I just figured that drupal's session timer would be based on inactivity rather than absolute time (even if that is 23 days of inactivity to allow for large posts broken up over time). Anyways, thank you for that link, it looks very promising. I'll report back if it seems to work out for me. – BlargleMonster Oct 07 '13 at 12:58

Drupal Session doesn't seem logical

2 Answers2