Question

On this site I have a situation where a user might need to be logged in over a very long period of time (days, weeks, maybe months in certain cases). The problem is I see in the server logs that they frequently end up not logged in so that an attempt to connect results in being redirected to the login page.

This is client that is automatically connecting every minute, by the way.

It appears they are being logged out under certain circumstances (Power outage? Computer going to sleep? Some other network interruption?). Normally the user makes a connection to the server every minute so they should be able to stay logged in, yes? I left a connection running for a couple of days and stayed logged in the entire time.

My pertinent session settings are:

session.cache_expire       180
session.cookie_lifetime    0
session.gc_maxlifetime     1440
session.use_cookies    On
session.use_only_cookies   Off

The checking of logged in status is handled by Zend Framework’s Zend_Auth. For me to remain logged in for over a day would mean that I am not running into either the cache_expire limit or the gc_maxlifetime, correct?

The only way I could simulate the logout that seems to be happening was to make a connection (establishing a session) then leave the computer offline overnight. When I went online again the next day and the client attempted to continue connecting (it does this automatically) I found I was logged out.

So my question(s).

1. Is my assessment of why the clients might be being logged out
   correct?

2. If so (or even if not), what can I do to prevent these log outs? Massively extend the various session time control settings?

Answer 1

Your problem is session.cookie_lifetime 0 It basically means that the session cookie will only be active until the client closes his browser. You can just set it to some high value like a year.

See the PHP documentation for more details.