Question

I’m using PHP5 here. I have made a login system that check’s the username and password against the records in the database. I want to use sessions to store the logged value. For example, when I reach the zone where I “log in” the user succesfully:

if($errors = 0) {
    $_SESSION['logged'] = "1";
}

The problem is that I want the $_SESSION['logged'] to stay active for let’s say 5 minutes so when I do a if($_SESSION['logged'] == "1") after this time to return false. Also, I would like to delete this session after the user closes the browser. Basically, I want a session configuration so that the user can safely leave his desk and when him or somebody presses refresh after 10 minutes or enters again after the browser has been closed, the session to be already removed, and the access to be restricted.

Can anybody help? Thanks.

Answer 1

Use session_set_cookie_params() to change the lifetime of the session cookie. Note that by default, it is set to 0 which means that the cookie is set until the user exits the browser. You can do this in the following way:

/* Set to 0 if you want the session
   cookie to be set until the user closes
   the browser. Use time() + seconds
   otherwise. */

session_set_cookie_params(0);
session_start();

Then check for the last activity time, updated each time someone visits a page.

if(($_SESSION['lastActivity'] + 300) < time()) {
    // timeout, destroy the session.
    session_destroy();
    unset($_SESSION);
    die('Timeout!');
} else {
    $_SESSION['lastActivity'] = time();
}