Expiration of fat-free framework sessions - php

Question

How do i set a fat-free framework session to expire after a duration, say 5 minutes, of inactivity? My web app keeps open until a user logouts out.

Answer 1

First of all you need to know about the PHP session garbage collector behaviour. By default, it triggers randomly on every 100th request (for performance purposes), looks for expired session files (default: 1440s) and remove them.
Also you need to know that some Linux distributions (e.g Debian/Ubuntu) disable this garbage collector and replace it with their own cron job.
You could start checking your PHP configuration:
foreach (['gc_probability','gc_divisor','gc_maxlifetime'] as $k)
echo $k,'=',ini_get("session.$k"),'<br>';
If the GC probability is 0, sessions files won't ever be removed (or could be removed by a cron job on Debian/Ubuntu). If it is not 0, but is low (e.g 1/100), sessions files will be removed some time (try to refresh the page 100 times).
In theory, you could set the probability to 1 (gc_probability=gc_divisor=1) to have sessions files removed as soon as they get expired. That would work on small apps with low traffic, but would affect performance on bigger apps (imagine that the GC needs to scan 1000 or more session files on each request).
The cleanest and most portable way of handle this issue is to expire sessions yourself. Every time you're loading a user session data, check the last time it was here and clear the session data if it's expired.
Here's a small example:
$f3->TIMEOUT=7200;// define session timeout here (in seconds)
ini_set('session.gc_maxlifetime',$f3->TIMEOUT);// see note (*) below
ini_set('session.cookie_lifetime',$f3->TIMEOUT);// optional (**)
$f3->route('GET|POST|DELETE /session',function($f3){
// load session data
$data=&$f3->ref('SESSION.data');
// sign in on POST requests
if ($f3->VERB==='POST') {
$data=['user'=>'John','stamp'=>time()];
$f3->reroute();
}
// sign out on DELETE requests
if ($f3->VERB==='DELETE') {
// sign out
$data=NULL;
$f3->reroute();
}
// check if session has expired
if (is_array($data) && time()>$data['stamp']+$f3->TIMEOUT) {
$data=NULL;
}
// check if user is authenticated
if (is_array($data)) {
echo 'Welcome ',$data['user'],' last time we\'ve seen you was ',date(DATE_W3C,$data['stamp']);
echo '<form action="" method="post"><button>Sign out</button><input type="hidden" name="_method" value="DELETE"/></form>';
$data['stamp']=time();// update session stamp
} else
echo 'You\'re not authenticated';
echo '<form action="" method="post"><button>Authenticate as `John`</button></form>';
});
Of course, you'd better wrap all this logic in a dedicated class.
(*) PHP GC maxlifetime should not be lower than $f3->TIMEOUT, otherwise it could interfere with it. Let's say $f3->TIMEOUT equals 7200 and session.gc_maxlifetime is set to 1440 (default), there are chances that your user sessions get expired between 1440 and 7200. NB: On Debian/Ubuntu, you should set this parameter inside php.ini otherwise the cron job cleaning up session files won't be aware of it.
(**) If you skip this line, the session cookie lifetime defaults to 0, which means "until the browser is closed". See here.