2

My ZF2 application logs out after a short period of inactivity - say, 60 minutes or so - and I can't understand why.

I have an 'auth' object which is a singleton that composes an instance of Zend\Session\Container. Its constructor creates the container with this following line:

$this->session = new Container('Auth');

The auth object has a login() method that stores the current user with the following line:

$this->getSession()->userId = $user->id;

The auth object also has an isLoggedIn() method that tests the status as follows:

if ($this->getSession()->userId) {
     return true;
}
return false;

That's all pretty straightforward. Yet, from time to time when the bootstrap is checking to see if we are logged in, it comes back with false. Why?

Here's a printout of the config from the session manager:

'cookie_domain' => '',
'cookie_httponly' => false,
'cookie_lifetime' => 604800,
'cookie_path' => '/',
'cookie_secure' => '',
'name' => 'MyApplication',
'remember_me_seconds' => 1209600,
'save_path' => '/var/lib/php5',
'use_cookies' => true,

As you can see, the remember_me_seconds and cookie_lifetime are set to 2 weeks and 7 days respectively. Is there some other setting that I should be looking at?

I read somewhere that the default save handler, 'file', does not support concurrency. My bootstrap also opens a session container to the auth namespace with new Container('Auth'). Could this be conflicting with the Container in the auth singleton ? I doubt it, since the problem would then be likely to occur in periods of high activity (not after a period of inactivity). Also, I would expect to see an exception.

Woe is me.

EDIT: It is also worth noting that the session ID does not change when logged out, or upon logging back in.

DatsunBing
  • 8,684
  • 17
  • 87
  • 172

1 Answers1

0

There are many points why a session can become invalid.

check always following points:

  • session cookie lifetime (should become invalid only when closing the browser)
  • session lifetime itself
  • cache_expire key in zf2 (should be higher than session lifetime)

Try to add this

    //NEW SECTION
    'cache_expire'         => 60 * 26, <-- this may help
    'gc_maxlifetime'       => 60 * 60 * 24, <-- or this
ThaDafinser
  • 499
  • 3
  • 13