This is a longish post as I have tried to add in as much detail as I possibly can
We have been having this issue since moving the system from one server to another and upgrading from PHP 7.3.x to PHP 7.4.
The web-based system in question has multiple users log in to their accounts to access functionality. Since moving from one version of PHP to another and servers, people using the system are reporting that they are being logged out faster than usual. On both versions of the php.ini files we have the below:
session.gc_maxlifetime = 3600
session.cache_expire = 180
I have tried to mirror everything in both files except some extensions that I feel don't need to be used (See below extensions)
;extension=bz2
;extension=curl
;extension=ffi
;extension=ftp
;extension=fileinfo
;extension=gd2
;extension=gettext
;extension=gmp
;extension=intl
;extension=imap
;extension=ldap
extension=mbstring
;extension=exif
extension=mysqli
;extension=oci8_12c
extension=odbc
extension=openssl
;extension=pdo_firebird
;extension=pdo_mysql
;extension=pdo_oci
extension=pdo_odbc
;extension=pdo_pgsql
;extension=pdo_sqlite
;extension=pgsql
;extension=shmop
extension=php_pdo_sqlsrv_74_ts_x64.dll
extension=php_sqlsrv_74_ts_x64.dll
;extension=snmp
;extension=soap
;extension=sockets
;extension=sodium
;extension=sqlite3
;extension=tidy
;extension=xmlrpc
;extension=xsl
The sessions ending aren't consistent and I cannot see a pattern between users and departments so I have done googling and looking on here and no answers have seemed to help. I have tried clearing the user's local profile and cookies from Chrome and this hasn't worked either.
TIMES OF IT KICKING ME OUT : ]
10:52-10:54
10:54 – 10:56
11-11-11:13
11:44 – 11:45
12:03-12:04
12:05-1206
12:51-12:52
13:15-13-18
13:31-13:32
I'm the Apprentice Developer who is trying to sort this as the Developer who managed all of this has left the company. I can provide the login script if needed but I figured it couldn't be that as it isn't consistent between users. Any help would be great :)
EDIT 1:
I thought I would add in the small login script to show that nothing is being set inside the script.
<?php session_start(); ?>
<?php require 'inc/_classes/class.user.php';?>
<?php
$user_login = new USER();
//below checks if isset($_SESSION['userSession']) and returns true
if($user_login->is_logged_in()){
$user_login->getUserData();
$userDash = $user_login->getUserDashBoard();
$dashURL = "dashboard.php";
if ($userDash == 2) {
$dashURL = "dashboard-warehouse.php";
}elseif ($userDash == 3) {
$dashURL = "credit-control-info.php";
}else {
$dashURL = "dashboard.php";
}
$user_login->redirect($dashURL);
}
//login button is pressed to send credentials
if(isset($_POST['btn-login'])){
$email = trim($_POST['txtemail']);
$upass = trim($_POST['txtupass']);
// Below checks if the user account is active and details match
if($user_login->login($email,$upass)){
$user_login->getUserData();
$userDash = $user_login->getUserDashBoard();
$dashURL = "dashboard.php";
if ($userDash == 2) {
$dashURL = "dashboard-warehouse.php";
}elseif ($userDash == 3) {
$dashURL = "credit-control-info.php";
}else {
$dashURL = "dashboard.php";
}
$user_login->redirect($dashURL);
}
}
?>
We also have a session file that stores all the global informtion we may need on pages.
$user_home = new USER();
if(!$user_home->is_logged_in()){
$user_home->logout();
$user_home->redirect('index.php');
}else{
$user_home->getUserData();
$userID = $user_home->getUserID();
$userName = $user_home->getUserName();
$areaSimNB = $user_home->getUserAreaSimNB();
$areaSimRTN = $user_home->getUserAreaSimRTN();
$user_functions = new userFunctions();
$rows = $user_functions->getUserFunctions($userID);
$function = array();
foreach($rows as $row){
$function[] = $row['FunctionID'];
}
if($areaSimNB == NULL || $areaSimRTN == NULL){
$areaNB = $user_home->getUserAreaNB();
$areaRTN = $user_home->getUserAreaRTN();
}else{
$areaNB = $user_home->getUserAreaSimNB();
$areaRTN = $user_home->getUserAreaSimRTN();
}
$globalGroup = false;
$globalDepot = false;
$globalArea = false;
if($areaNB == NULL){
$globalGroup = true;
}else{
if($areaNB < 7){
$globalDepot = true;
}else{
$globalArea = true;
}
}
$url = $_SERVER['REQUEST_URI'];
$user_home->logPage($userID, $url);
$customerView = $user_home->getUserCustomerView($userID);
if (empty($function)) {
$user_home->logout();
}
}
logout() is the only function that destroys the session and redirects the user to the login page
EDIT 2
I have done a Find All for "session_set" and "setcookie(" and no results have shown up. - In relation to a comment to another thread.
EDIT 3
I have tried clearing cookies on someones browser on Friday and they have said it seems to be better. I'm not saying this as an answer yet until I confirm this with other users and I will update the thread accordingly