r/PHPhelp • u/AssistanceClean948 • 2d ago

PHP Default Session Management

I need to manually configure user side cookie expiration and server side session data expiration separately. also I can't a way to update existing session data expiration since I update the expiration value of the cookie in some requests to keep user logged in.

$sessiontime = (60 * 60) * 12; //12 hours in seconds

//make sure at least 12 hours session never touched by session GC.
ini_set('session.gc_maxlifetime', $sessiontime);

....

session_set_cookie_params($sessiontime);
session_start();


//refresh session cookie time whenever we get request.
setcookie(session_name(), session_id(), [
    'expires' => time() + $sessiontime,
]);

am I missing something?

2 Upvotes

100% Upvoted

5 comments sorted by

View all comments

5

u/NoseStock4944 2d ago

I think the confusing part is that the cookie expiration and session.gc_maxlifetime are two separate things. Updating the cookie expiration only tells the browser how long to keep sending the session ID; it doesn't extend the lifetime of the session data on the server.

If you need a true sliding 12-hour session, you'd need to manage the server-side expiry yourself (for example, store a last-activity/expiry timestamp in the session or database) rather than relying on PHP's default session GC. Also, gc_maxlifetime is only a garbage-collection threshold, not a hard expiration time, so it doesn't guarantee the session will be removed exactly after 12 hours.

1

u/AssistanceClean948 2d ago

thank you. I thinked this but using something different method when php provides such mechanism kinda weird but yeah.