$config->sessionExpireSeconds does not work

[helmut2509]

In my PW-Application there is currently no session timeout.

I want to set the user session to 60 minutes which means that after 60 minutes of inactivity the user will be redirected to the homepage.

so I added the following entry to my config.php:

$config->sessionExpireSeconds = 120;

(120 seconds is just for testing).

But after five minutes of inactivity I am still logged in, there is no redirection.

Is there anything wrong or did I miss something?

In php.ini I have the entry:

session.cookie_lifetime = 3600

[louisstephens]

Just curious, could you post your code where you are redirecting based on the session? It might help with answers to see the whole picture.

[wbmnfktr]

Have you cleared all previous cookies and session files? Just to make sure there aren't any "old habits".

[helmut2509]

11 hours ago, louisstephens said:

Just curious, could you post your code where you are redirecting based on the session? It might help with answers to see the whole picture.

if(!session()->isLoggedin)
   session()->redirect(config()->loginUrl);

[wbmnfktr]

1. I added $config->sessionExpireSeconds = 120; to my config.php
2. deleted all cookies and sessions (/site/assets/sessions/)
3. opened a private window and logged in
4. waited 2+ minutes
5. clicked a link and was redirected to the login page

It works in the backend.

How and why there might be a difference in an application or frontend... I don't know. 

Maybe caching, maybing something that keeps the session alive.

Another thing is session()->isLoggedin where did you find that? All I know is $user->isLoggedin().

Maybe you could try:

if(!$user()->isLoggedin)
   session()->redirect(config()->loginUrl);

 

[helmut2509]

11 hours ago, wbmnfktr said:

1. I added $config->sessionExpireSeconds = 120; to my config.php
2. deleted all cookies and sessions (/site/assets/sessions/)
3. opened a private window and logged in
4. waited 2+ minutes
5. clicked a link and was redirected to the login page

It works in the backend.

How and why there might be a difference in an application or frontend... I don't know. 

Maybe caching, maybing something that keeps the session alive.

Another thing is session()->isLoggedin where did you find that? All I know is $user->isLoggedin().

Maybe you could try:

if(!$user()->isLoggedin)
   session()->redirect(config()->loginUrl);

session()->isLoggedin is just a custom variable filled with 'true' after successfull login.

I found out that the session is not being saved in /site/assets/sessions/ but in the sessions table of the processwire database.

But strangely entries are only made at logout, never at login. Even after adding the $session()->login() command nothing changed.

 

 

 

[wbmnfktr]

12 hours ago, helmut2509 said:

session()->isLoggedin is just a custom variable filled with 'true' after successfull login.

Try the $user->isLoggedin() option.

12 hours ago, helmut2509 said:

I found out that the session is not being saved in /site/assets/sessions/ but in the sessions table of the processwire database.

But strangely entries are only made at logout, never at login. Even after adding the $session()->login() command nothing changed.

I don't know enough about session handling in ProcessWire and why this is the way it works in your setup.

Which version of ProcessWire are you running? Are there any other broader modifications/custom codes for session or user handling?

Did you install any session related modules that may interfere here?