Re: setting session timeout through .htaccess

On Sun, 13 Nov 2005 19:49:41 GMT, Ciphex .? <ciphex@xxxxxxx> wrote:

>Forgive me If I am missing something but do PHP sessions not live for
>the life of the browser?
>In all of my sessions work with PHP (which has been limited) the
>session identifier cookie is set automatically by PHP with an expiry
>time of the life of the browser... so until someone quits IE or Firefox
>or whatever... their cookie is alive... therefore when they try to
>access the session data again, as long as they didn't quit their
>browser before going to the john.... then their form would work as
>expected when they return.

The cookie may be a browser-session cookie (by default) with no timeout, but
PHP has its own timeout after which the session data is subject to deletion.
(There's nothing to stop someone opening a browser, starting a session and
keeping that browser open for a year...)

Since there is no way for PHP to know when a user has closed their browser,
PHP must have a way of expiring the session data from the server.

Also, the session cookie doesn't have to be a browser-session cookie anyway,
it can be a normal cookie with a specific timeout.
--
Andy Hassall :: andy@xxxxxxxxxxx :: http://www.andyh.co.uk
http://www.andyhsoftware.co.uk/space :: disk and FTP usage analysis tool
.

Relevant Pages

  • Re: Looking for general advice on security
    ... PHP pages have to be world-readable, ... SSL provides a way for a thief with a browser to communicate with ... cookies because the user can't fake a session with arbitrary contents, ... Try to send a message to the user and see if the mail server ...
    (comp.lang.php)
  • Re: Sessions
    ... click the link and in aoltest3.php the session variable is visable. ... Registered serializer handlers php php_binary wddx ... session.name PHPSESSID PHPSESSID ... see the PHPSESSID, in a cookie, or in the URL. ...
    (comp.lang.php)
  • Re: _SESSION weirdness behind a NAT firewall/router: bug?
    ... that the 'sess_deleted' file is actually being used as a session ID. ... force the cookie to expire. ... Any $_SESSION values introduced by one browser become part of the ... I re-load the non-logged-in index page in Opera. ...
    (comp.lang.php)
  • Re: php session without cookie useage
    ... >>> browser or the application to maintain the state if needed. ... >>> transfer a session key created on login to subsequent pages via a POST ... >>> browser via a cookie or via POST or GET. ... > That may block legitimate users using a round-robin proxy (different ...
    (comp.lang.php)
  • Re: [PHP] close session when browser is closed
    ... Even the lifetime of the session cookie is depending on which browser the ... re-use the same session ID and will work with php pages without any ...
    (php.general)