PHP会话超时/注销

Question

I'm trying to understand when a PHP session will timeout and force the user to log back in again.

When the user first logs in to the site successfully I'm setting a session global like this:

$_SESSION['AcmeAuthenticated'] = TRUE;

On every other page I check at the top of the page for this:

if (!isset($_SESSION['AcmeAuthenticated']) and $_SESSION['AcmeAuthenticated'] !== TRUE) {
 header('Location: index.php');
 die;
}

I've noticed during development that I can keep my browser open all day and it won't ask me to login again. If I quit the browser then it will prompt me to login again. I checked the PHP info and session.gc_maxlifetime is set to 900 - I took that to mean that the PHP session would end in 15 minutes?

I'm new to PHP so still trying to learn how sessions work and when the timeout comes into effect.

Answer 1

When you exit your browser, it will clear all SESSIONS. That is why you always have to relogin every time you exit your browser. However, yes, you can set how long you want the SESSION to last for. It shows you how here: How do I expire a PHP session after 30 minutes?