PHP - Prevent Users from Being Logged Out

1
votes

On this site I have a situation where a user might need to be logged in over a very long period of time (days, weeks, maybe months in certain cases). The problem is I see in the server logs that they frequently end up not logged in so that an attempt to connect results in being redirected to the login page.

This is client that is automatically connecting every minute, by the way.

It appears they are being logged out under certain circumstances (Power outage? Computer going to sleep? Some other network interruption?). Normally the user makes a connection to the server every minute so they should be able to stay logged in, yes? I left a connection running for a couple of days and stayed logged in the entire time.

My pertinent session settings are:

session.cache_expire       180
session.cookie_lifetime    0
session.gc_maxlifetime     1440
session.use_cookies    On
session.use_only_cookies   Off

The checking of logged in status is handled by Zend Framework's Zend_Auth. For me to remain logged in for over a day would mean that I am not running into either the cache_expire limit or the gc_maxlifetime, correct?

The only way I could simulate the logout that seems to be happening was to make a connection (establishing a session) then leave the computer offline overnight. When I went online again the next day and the client attempted to continue connecting (it does this automatically) I found I was logged out.

So my question(s).

  1. Is my assessment of why the clients might be being logged out correct?

  2. If so (or even if not), what can I do to prevent these log outs? Massively extend the various session time control settings?

2
phpzend-frameworksession
Maybe drop a cookie indicating that a user is logged in, and check against that? – Alexander Corwin
Have a look at samy.pl/evercookie - it's truly obnoxious but gets the job done :) – AlienWebguy

2 Answers

4
votes

Your problem is session.cookie_lifetime 0 It basically means that the session cookie will only be active until the client closes his browser. You can just set it to some high value like a year.

See the PHP documentation for more details.

1
votes

I think your assessment sounds reasonable, though I doubt the logouts are power-grid related, perhaps more to do with localized firewall, cookie settings or dynamic IP issues?

Have you considered using ajax to continually update session times behind the scenes? I've used this method successfully several times:

Here's where I found the idea. It's a concise treatment of the problem.

http://brian.moonspot.net/2008/05/14/php-session-cookie-refresh/

Hope that helps! A