Secure Login with Remember

Question

I need help with a login script. The problem is that the session is automatically expiring after a certain downtime. I would like to increase the native limit of session of my pages, because the user needs to stay connected to the system all day, and stay logged in when the session expires becomes a nuisance for users. I have tried session_cache_limiter(600); to increase the limit, however, on the server does not work, the session is destroyed in 2 hours.

My script is basically like this, when logging I create three SESSION as follows log in.php:

$_SESSION['cod_cliente'] = ($row["cod_cliente"]);
$_SESSION['op'] = ($row["usuario_id"]);
$_SESSION['op_tipo'] = md5($row["tipo"]); //perfil

I have a page that checks if the user is logged in check php.:

if(!isset($_SESSION['cod_cliente']) && empty($_SESSION['cod_cliente']) || !isset($_SESSION['op']) || empty($_SESSION['op']) || !isset($_SESSION['op_tipo']) || empty($_SESSION['op_tipo']))
{
    session_unset();     
    session_destroy();
    header('Location:login.php');
}

And on the pages I want to protect I put at the beginning:

session_start();
include("check.php");

Answer 1

I’m sorry I was wrong about the previous answer, I couldn’t test, so I made a mistake.

To change the settings of php.ini without editing the file use the function ini_set() (some hosting block such function), use it precisely to change the gc_maxlifetime of the session, and to ensure use also session_set_cookie_params() which has as its first parameter the lifetime.

I made a simple example, where I define the session with a maximum time of 30 seconds, and even so I use session_cache_expire() to clean up my cache after 1 minute to actually close my session (you only need to delete the cache when session time is less than 180 minutes, as every 180 minutes cache is deleted by default). Be the example:

index php.:

<?php
    // define tempo de sessão para 30 seguntos (deve informar valor ente aspas)
    ini_set('session.gc_maxlifetime', '30');
    session_set_cookie_params('30');

    /* define a exclusão do cache após 1 minuto (apenas para a variável
       não ficar no cache por 180 minutos, para fazermos o tete) */
    session_cache_expire(1);

    session_start(); //inicia

    $_SESSION['logado'] = "Logado"; // Uma variável de teste

?>
<a href="verifica.php">Verificar</a>

php checks.:

<?php
    session_start(); // pega sessão
    echo $_SESSION['logado']; // exibe variável de sessão (será exibido erro quando ela for apagada)
?>

To test just access the index.php, after one minute access verifica.php and the session variable will not be set. Sometimes you can give a difference because of the cookies session that keeps holding the variable in memory.

Answer 2

I have faced problems where I put session for unlimited time and still expire after a period of inactivity and in my case was the Garbage Collector.

The configuration gc_maxlifetime of php.ini configures how long a session has to be considered disposable, closing it even if it has not reached the total limit.