check if a PHP session known by the sessionid is active

Question

We are locking some inventory for clients, the table that locks the inventory contains the session ID of who locked it together with other information about the client. When the session expires we want to unlock that inventory so other people can purchase it. Because we register the session_id() in the table, knowing it, is there a way to check if the session is still active in PHP?

If we are using the DB to keep the session we can probably check if the row is till there and when was the last activity was, in memcached we can probably figure out the key of the session and check it like that, for the file session we can probably do the same, figure out the file name for the session and check if the file exists.

Is there something that works everywhere no matter where you keep the session?

Answer 1

You can't use session_id, session_start etc.

These functions handle session of a user, that requests a page. You can't use them to handle a list of all users' sessions easily. You have to worry about the same rights for a user-created sessions (www-data) and a cli script, that will be executed to find which should be unlocked - sessions' files are for owners only.

In adddition session's access time is changed, so every check for a session you change it's time and influence sessions' behaviour.

How to perform locking easier

Usually locking of goods is made just for a fixed amount of time, say 20min. But if you wish to hold inventory selected while session is alive, you can use a slight modification of existing code.

1. Add a new field last_activity next to session_id field (one simple migration)
2. Every request update it to NOW (just call $row->touch() on a model - docs).
3. Make a crontab task to remove every line with last_activity < NOW - delta, where delta is a session timeout.

Using this approach you can avoid dealing with every session driver.

P.S. You will probably want to be sure that session is dead after a certain amount of time, read this question. If this job is done by a garbage collector, session lifetime can vary.

Answer 2

In summary, you are asking if there is a generic approach within PHP to access any session. Although the use case in the question is plausible, the impact of being able to do what you suggest poses a massive security risk.

That is one reason why the inbuilt session functionality within PHP makes doing what you require difficult.

In theory you may be able to use the inbuilt PHP session functions to specify specific session ID's and look them up. I have just done a few simple tests and not had much success. There is only one inbuilt function for loading sessions 'session_start' which would need to be called repeatedly. The manual specifically says this won't work:

As of PHP 4.3.3, calling session_start() after the session was previously started will result in an error of level E_NOTICE. Also, the second session start will simply be ignored.

It may still be possible to work around this, perhaps with forking or other clever fiddles. But your code would be working in an obscure way which could break with future PHP updates or possibly interfere with existing live sessions.

The best solution, would be to write a tool specific to the session handler in use that allows read only access to the session. The scenario in the question doesn't even need access to the session data, just the timestamp information which can be used to calculate the expiry time.

In the case of 'files' session handling. The path to the session file store can be discovered with ini_get('session.save_path');. The checking script may need to run with the same permissions as the web server in order to access this location.

The script would need to run frequently on a schedule to check for expired sessions and remove the locks from the inventory.

Answer 3

You can actually use session_id and session_start for this purpose.

$ids = [
            '135b29ef958a23418f2a804474787305', // active session
            '135b29ef958a23418f2a804474787306', // inactive session
            '135b29ef958a23418f2a804474787305', // active session
        ];

foreach($ids as $id)
{
    session_id($id);
    session_start(); 

    $status = isset($_SESSION['logged_in']); 

    print( ($status ? 1 : 0) . PHP_EOL);
    session_abort();
}

Check if an session variable that is always set exists. To make sure this isn't a newly created session.

You'll have to check if this doesn't reset the lifetime-counter on the session. On my system it doesn't impact the lifetime until something changes in the session

Edit: updated with session_abort to loop and check multiple session-ids

Answer 4

Check is session exist in session folder:

echo ini_get('session.save_path');

for example in my folder session id file:

sess_l75lm4ktlhvlu566n8i6do8k71

Set session parametrs (for example):

ini_set('session.cookie_lifetime', 100)

After session_destroy(); file was deleted from session folder:

        if (file_exists($sessionfile)) {
        echo "exists";
    }else{
        echo "not exist"
    }

Or You can send js request when close browser and unlock product (firefox tested):

    <script type="text/javascript">
    // alert(document.cookie);

    window.onbeforeunload = function () {
    return "Do you really want to close?";
    };
    window.onunload = function () {
    return "Do you really want to close?";
    };

    $(window).on('beforeunload', function(){ alert ('Send post to unlock product')});
    $(window).unload( function () { alert("'Send post to unlock product'"); } );
</script>

Answer 5

You can put code in your function which logs out the user, that should handle the unlocking of the inventory related to that session.

Answer 6

Closing of the browser window triggers the event beforeunload, something that can only be handled by Javascript. You could put in a Javascript event handler for that event which makes an AJAX call back to the site, like so (jQuery example given):

$(window).bind("beforeunload", function() { 
    $.ajax({
        url: "http://example.com/destroySession.php"
    });
});

That call back to the site could be against a page that unlocks the inventory items against the user's sessionID, after which the PHP command session_destroy() is called. For example:

<?php

// Load your config bootstrap / etc.

session_start();

// Unlock target inventory items

session_destroy();

?>

Answer 7

What you could do is keep a flag(eg. last_activity), in each user session, that to check your session was active and find out whether to unlock the item or keep it locked. Here is what worked for me:

$sessionId = get_session_id_that_locked_the_item_from_db();

if(session_status() !== PHP_SESSION_ACTIVE) {
    session_start();
}
// get current session id.
$current_id = session_id();
// renew activity.
echo 'Renewed my activity.';
$_SESSION['active'] = 1;
// Close the current session
session_write_close();

if($current_id === $sessionId) {
    // the current user has locked the item.
}
// Check if the var active of this session exists.
elseif(!checkSessionlastActivity($sessionId, $current_id)) {
    // Show the inventory item.
    showInventoryItem();
    // Lock inventory when the item is selected(eg added to basket).
    if('I want to lock the item') {
       lockInventoryItem($current_id);
    }
}
else {
    echo 'Item is locked.';
}

function checkSessionlastActivity($id, $current_id) {
    // switch session to the one that locked the item.
    session_id($id);
    session_start();
    // get session is active.
    $active = ( isset($_SESSION['active'])? $_SESSION['active']: null);
    // Close the session.
    session_abort();
    // restore current session.
    session_id($current_id);
    session_start();

    if($active !== null) {
        return true;
    }
    return false;
}

function lockInventoryItem($current_id) {
    put_my_session_id_to_db($current_id);
}

function showInventoryItem() {
    echo 'You can select item';
}

Note: I am not sure if this is going to work for different systems. It may be depended on your php session settings.

Opinion: Session is used for a specific functionality. I think switching between sessions that belong to different users is not what sessions were designed for. Anyway, I would advice you to use this workaround until you implement a locking solution for your inventory.

In the case you will only rely whether the session has expired or not, check your session settings(session.gc_maxlifetime, session.gc_probability & session.gc_divisor) and also this can helpful.

Answer 8

// correct way
$id = 'abc';
session_id($id);
session_start();
$isActive = (session_status() === PHP_SESSION_ACTIVE);
session_write_close();
var_dump($isActive);

// tricky way (root required)
$id = 'abc';
$isActive = false;
$sessionTimeout = (int)ini_get('session.gc_maxlifetime');
$rdi = new RecursiveDirectoryIterator(session_save_path(), FilesystemIterator::SKIP_DOTS);
$rii = new RecursiveIteratorIterator($rdi);
$ri = new RegexIterator($rii, preg_quote("/sess_$id/"), RegexIterator::MATCH);
/**
 * @var $fileInfo SplFileInfo
 */
foreach ($ri as $fileInfo) {
    $expiredAt = $fileInfo->getMTime() + $sessionTimeout;
    $isActive = $expiredAt > time();
    if ($isActive) {
        break;
    } 
}
var_dump($isActive);

Generally, to store the session id in DB and not to keep session there - it's a bad idea.

Take a look at http://php.net/manual/en/function.session-set-save-handler.php

Based on your profile, you know yii. There is a good example of implementation:

https://github.com/yiisoft/yii2/blob/master/framework/web/DbSession.php

https://github.com/yiisoft/yii2/blob/master/framework/web/Session.php#L97

https://github.com/yiisoft/yii2/blob/master/framework/web/Session.php#L148