PHP session expiring after 40 minutes - php

Question

I wrote this code to manage the sessions so that they should expire when browser is closed or if the user is inactive for a defined time (2 hours). However it seems that the sessions are expiring after 40 minutes of inactivity, and i really dont get how's this possible. If my code is failing, i would expect that they should last 1440 seconds (24 minutes).
define("MY_SESSION", "mysession");
define("SESSION_DURATION", 7200);
function my_session_start() {
if (session_status() != PHP_SESSION_NONE)
return;
ini_set('session.gc_maxlifetime', SESSION_DURATION);
ini_set('session.cookie_lifetime', 0);
session_set_cookie_params(0);
session_name(MY_SESSION);
session_start();
if ((!isset($_SESSION['EXPIRES'])) || ($_SESSION['EXPIRES'] < time())) {
$_SESSION = array();
session_unset();
session_destroy();
session_start();
}
$_SESSION['EXPIRES'] = time() + SESSION_DURATION;
if (isset($_SESSION['REGENERATE'])) {
$_SESSION['REGENERATE']++;
if ($_SESSION['REGENERATE'] >= mt_rand(90,100)) {
$_SESSION['REGENERATE'] = 0;
session_regenerate_id(true);
}
}
else {
$_SESSION['REGENERATE'] = 0;
session_regenerate_id(true);
}
}
I placed my_session_start() in each PHP file.
I'm on a shared server but ini_set() is not blocked, and by launching a phpinfo() after my_session_start() i can see that session.gc_maxlifetime local value is being set to 7200 (while master value is 1440). session.gc_probability and session.gc_divisor are left at their default values (respectively 1 and 100).
I'm also regenerating session ids on a random base of 90-100 page loads / AJAX calls but that doesnt matter since i tried also to comment out that part and it did not solve the problem.
So, am i doing something wrong with my code? Where does that minutes amount come from, i mean why 40 minutes?

Answer 1

So i finally figured out how to fix this issue.
The solution was to change the session files saving folder:
ini_set('session.save_path', "/the/new/path/to/sessions/"); //DEFAULT: /var/lib/php5
Doing this implies that the session files might be viewed, so i added .htaccess file containing:
deny from all
inside "/the/new/path/to/sessions/" folder. So nothing can be viewed from outside the server.
Also, i had to add a new session garbage collection function:
function clear_old_sessions() {
$folder = "/the/new/path/to/sessions/";
$files = scandir($folder);
for ($i = 0; $i < count($files); $i++) {
$file = $folder . $files[$i];
if (is_file($file))
if (substr($files[$i], 0, 5) == "sess_")
if ((filemtime($file) + SESSION_DURATION) < time()) // SESSION_DURATION previosuly defined as 7200 (seconds)
unlink($file);
}
}