3

I want to increase my session timeout to around 24 hours and for this I searched net but nothing helped me out. presently my website make the session of around 40 mins after this is expires i want to make this to 24 hours. In my core.php I added these lines

Configure::write('Session.timeout', '864'); // Session will last 24h
Configure::write('Session.autoRegenerate',true);
Configure::write('Security.level', 'medium');

any idea or sugesstion.

Jpm
  • 166
  • 4
  • 18
  • Possible duplicate: http://stackoverflow.com/questions/9292890/modify-session-cookie-expiry-and-session-timeout-for-a-cakephp-session/ – trante Mar 02 '14 at 08:01

1 Answers1

4

The naming of the CakeSession config parameters is confusing and setting them is not always consistent (see below for example).

1) Configure::write('Session.timeout', 'XXX'); is the number of minutes session will last. So if you want it to last 24 hours, set it to 24*60.

2) Configure::write('Session.autoRegenerate',true); is not linked to 'Session.timeout' -- even though the Cake docs implies it is. autoRegenerate is dependent on the CakeSession::$requestCountdown value. $requestCountdown is the number of pageviews before the session ID is regenerated. It is NOT time-based.

So here comes the inconsistency: how do we set the CakeSession::$requestCountdown value? Not the same way we do the other params. You have to set it in bootstrap via:

App::uses('CakeSession', 'Model/Datasource');
CakeSession::$requestCountdown = 25;

This value can NOT be set via Configure like the other params (as of v2.4). See the ticket I opened on this that confirms that the above is the intended usage: https://github.com/cakephp/cakephp/issues/2078

3) Configure::write('Security.level', '?????'); has been removed since Cake 2.0.

ref: http://book.cakephp.org/2.0/en/development/sessions.html

Costa
  • 4,851
  • 33
  • 30
  • Thanks for clearing me these things as a am new to CakePHP. Now is there any other alternate to set the session.timeout. I want that if the user is inactive to more that 2 hrs the session expire not before two hours. presently is it only 40 mins. – Jpm Jul 18 '13 at 04:51
  • There is no built-in Cake functionality for that. You'd have to store the "last access time" in the session, then on every page view compare that time to the the current time, and if the difference is greater than 2 hours you manually log them out (see the "Example #1" on http://www.php.net/manual/en/function.session-destroy.php for a reliable method of doing this) – Costa Jul 18 '13 at 05:11