How to keep the user's session active even after closing the browser or coming back after some idle time in PHP?

Question

In my code I have the option to select "Remember me", which when checked saves the values of the email and password in a cookie and the cookie lasts 1 month, now, when the user enters the page again, the session does not it stays active, but it does get the values from the saved cookie and displays it on the login form. I am currently using cloudflare and a hosting, I already tried to establish these lines of code:

php_value session.cookie_lifetime 2629800;
php_value session.gc_maxlifetime 2629800;

both in the php.ini and the .htacces but the result is the same (when the user closes the browser the session is closed).

This is the loginUser function that handles the login and creates a cookie if the user checks "Remember me" and what I want is that by checking remind me the session stays active even if the user closes the browser or comes back after some time inactivity, but that the session has a duration of 1 month (2629800s).

function loginUser($email, $password, $rememberme)
{
    $mysqli = connect();
    $email = trim($email);
    $password = trim($password);
    
    if ($email == "" || $password == "") {
        return 'Both fields are required';
    }

    $email = filter_var($email, FILTER_SANITIZE_EMAIL);
    $password = filter_var($password, FILTER_SANITIZE_SPECIAL_CHARS);
    
    $sql = "SELECT * FROM users WHERE email = ? LIMIT 1";
    $stmt = $mysqli->prepare($sql);
    $stmt->bind_param("s", $email);
    $stmt->execute();
    $result = $stmt->get_result();
    $data = $result->fetch_assoc();

    if ($data == NULL) {
        return 'The email does not exist, sign up to enter';
    }

    if (password_verify($password, $data["password"]) == FALSE) {
        return 'The password is incorrect, please check and try again';
    } else {
        $user_id = $data['user_id'];
        $_SESSION['auth_user_id'] = $user_id;
        $_SESSION["user"] = $email;
        $_SESSION["pass"] = $password;
        $_SESSION["username"] = $data['username'];
        $_SESSION["verify"] = $data['verify'];
        $_SESSION["profile"] = $data['profileImage'];
        $_SESSION["id"] = $data['user_id'];
        $_SESSION["vip"] = $data['vip'];

        setcookie('user_id', $data['user_id'], time() + 60 * 60 * 24 * 30, '/');

        if ($rememberme) {
            $cookie_name = 'Remember_US';
            $cookie_value = json_encode(array('lemail' => $email, 'lpassword' => $password));
            $cookie_expire = time() + (60 * 60 * 24 * 30);
            setcookie($cookie_name, encrypt($cookie_value), $cookie_expire, '/', null, true, true);
        }
        header("location: index.php");
        exit();
    }
}

PS: I know this is a duplicate, but none of the questions above fixed my problem.

I mention again, I tried to set these lines in the htaccess and in the php.ini and I didn't succeed:

php_value session.cookie_lifetime 2629800;
php_value session.gc_maxlifetime 2629800;

//In functions.php
$expire = 60*60*24*30; // We choose a one year duration
ini_set('session.gc_maxlifetime', $expire);
session_start();

It is also worth mentioning that by establishing the lines of code when I close the browser and reopen it, the session remains active, but it only lasts a maximum of 2 hours.

Answer 1

TL;DR The setcookie lifetime is being confused with the lifetime of the default PHPSESSID cookie for $_SESSION.

To make $_SESSION respect the desired lifetime, its PHPSESSID cookie must be updated to change the cookie_lifetime from its default to one month. This involves managing $_SESSION manually. The following is an example workflow for managing $_SESSION manually:

1. Set the session_name. (An alternative cookie name to PHPSESSID can be set.)
2. Configure session options. (This can include setting the cookie_lifetime.)
3. Create and/or set the session_id.
4. Start the session. (This step populates $_SESSION based on the session_id.)
5. Validate the session. (Check that the session_id and other authentication parameters are valid.)
6. Access and modify $_SESSION values.
7. Close the session. (Block $_SESSION from further changes before sending the session_id to the client.)

This link on Session Management Basics should be helpful. You could also read about PHP Session Fixation / Hijacking.

In the comments RiggsFolly offers advice to think about, and Chris Haas posted a good reference. Solutions like the reference seem to suggest storing a random string as a user lookup key, and a longer, hashed string for validation. The lookup and non-hashed validation string would use setcookie, while other values could use $_SESSION.