I'm trying to increase session timeout time

Question

I am trying to increase the SESSION time so that the users do not time out for 12 hours. This is a private site used only by employees and the timeout is annoying and it causes partially filled out data to be lost. According to what I read the following code should work:

ini_set('session.gc_maxlifetime',12*60*60); 
ini_set('session.gc_probability',1); 
ini_set('session.gc_divisor',1);        
session_start();

but it has no effect. Any thoughts?

thanks

Answer 1

ini_set('session.gc_probability',1); 
ini_set('session.gc_divisor',1);

These two are forcing PHP to run the session cleanup script for EVERY hit on your site. PHP's formula to run the gc is:

if (random() < (gc_probability / gc_divisor)) then
      run_session_garbage_collector()
}

Right now you've got 1/1, so 100% chance of the garbage collector being run. While extending the timeout period is good, you also want to REDUCE the chance the collector runs at all. Otherwise you're forcing PHP to do a full scan of ALL session files and parse EACH one, for EVERY hit on your site, to find the odd one or two that might have expired.

Try setting the gc_probability to 0 to completely disable the garbage collector.

As well, be aware that changing the settings, as you are, within a script with ini_set() doesn't change the timeouts/defaults that OTHER scripts use. This script might have a longer timeout and changed probability, but if other scripts hav ethe default timeout (10 minutes or something), then they'll happily nuke any "stale" sessions.

The proper place to set session timeout/cleanup settings is at the php.ini level, so that it applies to all scripts on the site, not just this single script of yours.