Question

How session works? Where to save the session value? How to increase session life time?

Answer 1

Sessions make HTTP a virtually stateful protocol, which in fact is stateless. Session data is client-specific but stored on the server side, usually a serialized array in a text file. (The behavior can be overridden in PHP using the session handlers, see session_set_save_handler().)

The server gives the client a cookie which contains an identifier (session id) which uniquely identifies that client. When an HTTP request is made, the cookie containing the session id is sent along with it, and the server locates the client’s session data and loads it, restoring the client’s virtual state. (Sometimes the id is not sent via a cookie but as a GET parameter, but that’s irrelevant.)

In PHP, you can access session state by using the $_SESSION superglobal, after using session_start() to create or resume a session.

Since HTTP is stateless, the server has no way of knowing when a client goes away (closes the browser window, goes out to buy some beverages…) Therefore, the only sensible thing to do is to measure the time that has passed since their last request, and assume them gone if it is over a threshold. This amount of time is called the “session timeout” or the “session lifetime.” You can set its default value in the php.ini file or using the ini_set() function. See the section on session directives in php.ini for more details.