CakePHP session/auth logging out intermittently

Question

I'm having reports and complaints from my user that they will be using a screen and get kicked back to the login screen immediately on their next request. It doesn't happen all the time but randomly.

I am using CakePHP and the Auth component, which seem to work well other than this issue

I got some feedback on the Cake forums once that this is sometimes caused by a 404 request that resets the session, i.e. if you have a broken image link or a missing favicon file. I have firebug open and there are no failed requests, so I ruled this out as a possibility, but the user is getting sporadically logged out. This seems to occur across browsers and operating systems.

Below is a summary of my config settings: Security.level = high Session.timeout = 1200 // this means my actual timeout should be 12,000 seconds Session.save = php

I am really at a loss as to what is causing this issue...

Answer 1

I have also had a problem with my security set to high. When you have it set to high it regenerates the session on every request: "CakePHP session IDs are also regenerated between requests if 'Security.level' is set to 'high'."

I had this problem cross-browser as well, so I know its not the best solution but I just changed the security setting to medium, and changed my session timeout to reflect that setting and have not had any problems since.

Answer 2

I had a similar problem, I found it to be the user_agent check in the core.php file, set this to false!

What was happening was after a page refresh the session id changed and I was logged out, but in the Session object there was an error saying Attempted Session Hijack!!! pr($this->Session);

Set this to false in core.php! Configure::write('Session.checkAgent', false);