Yii2 session expires after user is idle for a fixed seconds despite session timeouts being set to at least 1 day

Question

I have already added these codes in my config/web file

 'user' => [
        'identityClass' => 'app\models\User',
        'enableAutoLogin' => true,
         'enableSession' => true,
        'authTimeout' =>86400,
          'loginUrl' => ['account/login'],

    ],
      'session' => [
                    'timeout' => 86400,
            ],

After session expires I want to automatically logout and redirect to login action.

try `'enableAutoLogin' => false`. refer https://github.com/yiisoft/yii2/issues/5880 — Insane Skull, Feb 24 '16 at 08:42
the timeout you have is set to one day. Try setting it to a few seconds to test your sessions. — tripskeet, Feb 24 '16 at 16:52
Possible duplicate of [Session expiring in Yii2 despite user activity](http://stackoverflow.com/questions/29729026/session-expiring-in-yii2-despite-user-activity) — ScaisEdge, Feb 24 '16 at 18:55

score 2 · Answer 1 · answered Aug 12 '19 at 06:31

2

Make sure in your php.ini file
config

session.gc_maxlifetime

by default set as :

session.gc_maxlifetime=1440

change it, to :

session.gc_maxlifetime=86400

answered Aug 12 '19 at 06:31

Arie Satriananta

51
6

score 0 · Answer 2 · answered Sep 04 '17 at 11:35

Very first you have to set 'enableAutoLogin' => false, . now add these lines there in your config/web. I have added it in frontend/config/main.php because I am using frontend only.

'components' => [
...
        'user' => [
            'identityClass' => 'common\models\User',
            'enableAutoLogin' => false,
            'enableSession' => true,
            'authTimeout' => 1800, //30 minutes
            'identityCookie' => ['name' => '_identity-frontend', 'httpOnly' => true],
        ],
        'session' => [
            // this is the name of the session cookie used for login on the frontend
            'class' => 'yii\web\Session',
            'name' => 'advanced-frontend',
            'timeout' => 1800,
        ],
...

Now go to yii2/web/User.php and write code for destroy session in logout method before return as guest()-

public function logout($destroySession = true)
    {
        $identity = $this->getIdentity();
        if ($identity !== null && $this->beforeLogout($identity)) {
            ......
            if ($destroySession && $this->enableSession) {
                Yii::$app->getSession()->destroy();
            }
            $this->afterLogout($identity);
        }

        $session = Yii::$app->session;

        $session->remove('other.id');
        $session->remove('other.name');
              // (or) if is optional if above won't works
        unset($_SESSION['class.id']);
        unset($_SESSION['class.name']);
              // (or) if is optional if above won't works
        unset($session['other.id']);
        unset($session['other.name']);

        return $this->getIsGuest();
    }

For me it worked great.

Yii2 session expires after user is idle for a fixed seconds despite session timeouts being set to at least 1 day

2 Answers2