Question

I’ve a site where people login and a SESSION is created.

I have noticed that if you leave the site for long enough (not sure exact time frame) the session ends but the members is still in the site. They can still click and navigate around and I believe this has resulted in some meaningless data in the DB as SESSION variables like userID don’t exist.

I was looking for advice around logging users out when the SESSION ends.
I have looked at code like this – any better ideas?

 <?php if(!isset($_SESSION[]) {header(loginpage.php);}?>

Is there a better way to write the above code?

Where should this code be placed? Just on the navigation menu or really on any place a user can click?

Finally is there a way to understand when the SESSION naturally expires – is there a SESSION variable I can print to screen to see the timeleft etc?

thanks

Answer 1

You need to validate the session, you already headed into that direction with your code, but it’s not enough:

<?php if(!isset($_SESSION[]) {header(loginpage.php);}?>

It’s not enough because $_SESSION[] exists automatically after the session is started (the session mechanism in PHP, see session_start).

Instead, if you have saved the userID inside the session, check that one:

isset($_SESSION['userID'])

If the session really expired, it should not be set.