How often does a PHP session ID change per user?

Question

Just a basic question, if you open a session when a user visits the main page and you store the session id. When would that user return say another day/time and the id be different?

Answer 1

this depends on how the PHP is configured. specifically these settings control how often a php session id is "erased" by garbage collector:

http://php.net/manual/en/session.configuration.php#ini.session.gc-maxlifetime

session.gc_maxlifetime specifies the number of seconds after which data will be seen as 'garbage' and potentially cleaned up. Garbage collection may occur during session start (depending on session.gc_probability and session.gc_divisor).

http://php.net/manual/en/session.configuration.php#ini.session.gc-divisor

session.gc_divisor coupled with session.gc_probability defines the probability that the gc (garbage collection) process is started on every session initialization. The probability is calculated by using gc_probability/gc_divisor, e.g. 1/100 means there is a 1% chance that the GC process starts on each request. session.gc_divisor defaults to 100.

http://php.net/manual/en/session.configuration.php#ini.session.gc-probability

session.gc_probability in conjunction with session.gc_divisor is used to manage probability that the gc (garbage collection) routine is started. Defaults to 1. See session.gc_divisor for details.

As far as i know the default php session.gc_maxlifetime is 1440 seconds (24 minutes). The more visits you have in your site the most "accurate" these statistics are since all this algorithm will run more often.

A tricky edge case: if you start a session and then NEVER get any other visit to your site, the garbage collector algorithm will never run, hence the session will never expire! If you can understand this, i think you have understood this answer.