0

This is a longish post as I have tried to add in as much detail as I possibly can

We have been having this issue since moving the system from one server to another and upgrading from PHP 7.3.x to PHP 7.4.

The web-based system in question has multiple users log in to their accounts to access functionality. Since moving from one version of PHP to another and servers, people using the system are reporting that they are being logged out faster than usual. On both versions of the php.ini files we have the below:

session.gc_maxlifetime = 3600
session.cache_expire = 180

I have tried to mirror everything in both files except some extensions that I feel don't need to be used (See below extensions)

;extension=bz2
;extension=curl
;extension=ffi
;extension=ftp
;extension=fileinfo
;extension=gd2
;extension=gettext
;extension=gmp
;extension=intl
;extension=imap
;extension=ldap
extension=mbstring
;extension=exif
extension=mysqli
;extension=oci8_12c
extension=odbc
extension=openssl
;extension=pdo_firebird
;extension=pdo_mysql
;extension=pdo_oci
extension=pdo_odbc
;extension=pdo_pgsql
;extension=pdo_sqlite
;extension=pgsql
;extension=shmop
extension=php_pdo_sqlsrv_74_ts_x64.dll
extension=php_sqlsrv_74_ts_x64.dll
;extension=snmp
;extension=soap
;extension=sockets
;extension=sodium
;extension=sqlite3
;extension=tidy
;extension=xmlrpc
;extension=xsl

The sessions ending aren't consistent and I cannot see a pattern between users and departments so I have done googling and looking on here and no answers have seemed to help. I have tried clearing the user's local profile and cookies from Chrome and this hasn't worked either.

TIMES OF IT KICKING ME OUT : ]
10:52-10:54
10:54 – 10:56
11-11-11:13
11:44 – 11:45
12:03-12:04
12:05-1206 
12:51-12:52
13:15-13-18
13:31-13:32

I'm the Apprentice Developer who is trying to sort this as the Developer who managed all of this has left the company. I can provide the login script if needed but I figured it couldn't be that as it isn't consistent between users. Any help would be great :)

EDIT 1:

I thought I would add in the small login script to show that nothing is being set inside the script.

<?php session_start(); ?>
<?php require 'inc/_classes/class.user.php';?>
<?php 
    $user_login = new USER();
    //below checks if isset($_SESSION['userSession']) and returns true
    if($user_login->is_logged_in()){
    
        $user_login->getUserData();
        $userDash = $user_login->getUserDashBoard();
        $dashURL = "dashboard.php";
        
        if ($userDash == 2) {
            $dashURL = "dashboard-warehouse.php";
        }elseif ($userDash == 3) { 
            $dashURL = "credit-control-info.php";
        }else {
            $dashURL = "dashboard.php";
        }

        $user_login->redirect($dashURL);
    }
    //login button is pressed to send credentials
    if(isset($_POST['btn-login'])){
        $email = trim($_POST['txtemail']);
        $upass = trim($_POST['txtupass']);
        // Below checks if the user account is active and details match
        if($user_login->login($email,$upass)){
            
            $user_login->getUserData();
            $userDash = $user_login->getUserDashBoard();
            $dashURL = "dashboard.php";
            
            if ($userDash == 2) {
                $dashURL = "dashboard-warehouse.php";
            }elseif ($userDash == 3) { 
                $dashURL = "credit-control-info.php";
            }else {
                $dashURL = "dashboard.php";
            }

            $user_login->redirect($dashURL); 
        }
    }
?>

We also have a session file that stores all the global informtion we may need on pages.

$user_home      = new USER();
    if(!$user_home->is_logged_in()){
        $user_home->logout();
        $user_home->redirect('index.php');
    }else{
        $user_home->getUserData();
        $userID     = $user_home->getUserID();
        $userName   = $user_home->getUserName();
        $areaSimNB  = $user_home->getUserAreaSimNB();
        $areaSimRTN = $user_home->getUserAreaSimRTN();

        $user_functions = new userFunctions();
        $rows           = $user_functions->getUserFunctions($userID);
        
        $function       = array();
        foreach($rows as $row){
            $function[] = $row['FunctionID'];
        }

        if($areaSimNB == NULL || $areaSimRTN == NULL){
            $areaNB     = $user_home->getUserAreaNB();
            $areaRTN    = $user_home->getUserAreaRTN();
        }else{
            $areaNB     = $user_home->getUserAreaSimNB();
            $areaRTN    = $user_home->getUserAreaSimRTN();
        }

        $globalGroup    = false;
        $globalDepot    = false;
        $globalArea     = false;

        if($areaNB == NULL){
            $globalGroup = true;
        }else{
            if($areaNB < 7){
                $globalDepot = true;
            }else{
                $globalArea = true;
            }
        }

        $url = $_SERVER['REQUEST_URI'];
        $user_home->logPage($userID, $url);

        $customerView   = $user_home->getUserCustomerView($userID);
        if (empty($function)) {
            $user_home->logout();
        }
    }

logout() is the only function that destroys the session and redirects the user to the login page

EDIT 2

I have done a Find All for "session_set" and "setcookie(" and no results have shown up. - In relation to a comment to another thread.

EDIT 3

I have tried clearing cookies on someones browser on Friday and they have said it seems to be better. I'm not saying this as an answer yet until I confirm this with other users and I will update the thread accordingly

Tehcheatah
  • 108
  • 1
  • 9
  • 1
    Did you take a look on this answer: https://stackoverflow.com/a/30968208/3710053 – Siebe Jongebloed May 27 '21 at 16:57
  • PHP's session GC cleanup isn't exactly deterministic or reliable, and is certainly not anything you should have user-facing functionality reliant upon. If you want sessions to time out in a sane and reliable manner set/check a timestamp inside the session itself and set the cleanup to something a fair bit longer than that. – Sammitch May 27 '21 at 17:54
  • Are there any other PHP applications/scripts running on the same machine? If so, check that they not all share the same session storage directory, otherwise another app/script with _shorter_ GC collection settings could clean up more than intended. – CBroe May 28 '21 at 08:02
  • @CBroe There are no other applications or scripts on the Server. It is a fresh server with new installs of Apache and PHP and the system in the htdocs folder. – Tehcheatah May 28 '21 at 08:36
  • @SiebeJongebloed This wasn't on I had come across but I have given it a read. Within the script, we aren't setting any of the session variables from php.ini inside our PHP files. (Section 1 of thread). The server we are running on is "Windows Server 2019 Standard" which is a VM. (Section 2 of thread). As for saving of sessions in a file, I'm not sure if we do that as the saving file paths in the php.ini file are commented out. This was php's default so am kinda sure this wouldn't be it. – Tehcheatah May 28 '21 at 09:00

0 Answers0