Sessions and expiring cookies

From: Derek Fountain (nospam_at_example.com)
Date: 01/15/05 

Date: Sat, 15 Jan 2005 18:43:21 +0800

I set my session parameter so the session is a few minutes long, and if the
user goes inactive for that period the session expires. Two questions:

1) What mechanism actually expires the session? That is, what says "hang on,
the time limit has passed, so that's no longer valid"? It can't be the
browser, since that might be subverted or buggy. So does a browser send an
expired cookie value anyway and trust the website to spot it has expired?

2) How do I tell in my PHP that a session has expired? My code has a
start_session() at the top, and uses of $_SESSION[xxx] underneath, but
somewhere I should be checking that the session hasn't expired, shouldn't
I? Or maybe start_session() does that for me somehow? 

-- 
The email address used to post is a spam pit. Contact me at
http://www.derekfountain.org : <a
href="http://www.derekfountain.org/">Derek Fountain</a>

Relevant Pages

  • Question about redirecting to a "session expired" page...
    ... When a logged in user's session expires, I want that user redirected back to ... "AuthCookie" that gets set when you use the FormsAuthentication class? ... means the session expired and it would redirect back to the login page. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Avoiding page expiry?
    ... >:I'm using a webform that expires after a few minutes. ... On submitting the form after the expiry time any data is lost. ... session is regarded as being inactive while you fill out the form. ...
    (comp.security.misc)
  • Re: session wont timeout
    ... Maybe this is a session cookie issue? ... client browser there is this one: WSS_KeepSessionAuthenticated Expires: At ... If I kill the session cookie using IE Developer Toolbar, ... possible and IIS would throw another challenge. ...
    (microsoft.public.sharepoint.windowsservices)
  • Re: Random Session Expiration
    ... mentioned random. ... > Shrinivas Reddy wrote: ... >> I am working on ASP.NET application in which the session expires randomly on ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Fire a function when the session expires
    ... The problem is the session timeout. ... session expires the field "logged" remains set to Y. I'm in need to set it ... when ANY browser makes a session_startAND that triggers the session ...
    (comp.lang.php)