Question

This is really bugging me. Has been for years. No matter what I do with core.php or php.ini, my logins timeout after about an hour – usually. Some deployments of identical code and configuration timeout after a respectable amount of time.

This is what I have at the moment on one site – timed out after about an hour:

session.gc_divisor  1000
session.gc_maxlifetime  86400
session.gc_probability  1

Configure::write('Session.timeout', '28800');
Configure::write('Session.checkAgent', false);
Configure::write('Security.level', 'medium');

And another – lasted all night:

session.gc_divisor  100
session.gc_maxlifetime  14400
session.gc_probability  0

Configure::write('Session.timeout', '315360000');
Configure::write('Session.checkAgent', false);
Configure::write('Security.level', 'medium');

Now, before you get excited and say, “Well, the answer is there in the Session.timeout value”, let me tell you that this site usually times out after about twenty minutes!

Answer 1

Somewhere I read that on shared hosting, other applications can reset the session by clearing the php-defined session directory. This was alluded to by Rowlf in his answer.

CakePHP offers the option to configure the way sessions are handled. In core.php I changed this to 'cake' (by default it is 'php'):

/**
 * The preferred session handling method. Valid values:
 *
 * 'php'            Uses settings defined in your php.ini.
 * 'cake'       Saves session files in CakePHP's /tmp directory.
 * 'database'   Uses CakePHP's database sessions.
 */
Configure::write('Session.save', 'cake');

I also ensured that the session timeout and the corresponding php.ini values are the same:

/**
 * Session time out time (in seconds).
 * Actual value depends on 'Security.level' setting.
 */
Configure::write('Session.timeout', '86400');

So far, the system hasn’t logged out.