I have developed this PHP web application which is now running for some months. Suddenly one of the users complained that he was able to login, but the session was terminated as soon as he clicked on any button! The same problem happened on different browsers.
After some tests I realized that a brand new session ID was created every time the user clicked on any button, probably because the original session was expired.
For whatever reason I took a glance at the user’s computer clock and… surprise! His clock was 3 months in the future! I didn’t know if such thing could have any relation to the failure, but I did fix the clock. Still it didn’t work. I erased all cookies. Still nothing. So I restarted the browser – and then it started working again!
The closest information I got about this issue was Shimon Amit’s answer to this question. Good, now I know that the clock “misconfiguration” is the cause. The problem is… I cannot keep every customer’s computer clock under control. Some of them may have their computer clocks set in the future.
My question: is there any solution for this? Any trick? I don’t want customers to face such errors as they may find it “lame” and break their trust on the application, even though it’s not really my fault (in a sense).
You can extend your session timeout to a later date. Perhaps you can use cookies that don’t expire (sessions are related to cookies on the client side) Otherwise, your client’s browser is just doing what it’s designed to do.
EDIT: Javascript Option
This is a total hack, but you COULD use javascript to get the current time on the client machine and send it back to the server, then adjust the timeout on your session cookie to expire three months after that. See http://www.w3schools.com/jsref/jsref_gettime.asp
Once you have retrieved the client time, you can reset the session expiration using session_cache_expire(). http://www.php.net/manual/en/function.session-cache-expire.php
EDIT: 100% Server Side Option
Another option that I thought of would be to set a session cookie with no expiration, but track the time the cookie was set on the server, say in a MySQL table. You would also need to keep track of the last activity. Whenever a logged in user makes a request, you could check the start time of their session and their last activity. If the current time is greater than your acceptable timeout for either of these, then destroy the session server side and bring them back to the log in page. If the session is still ok, then update the last activity associated with that user so you can compare on the next request. No client side code necessary.