How To Elegantly Work With PHP Session Timeout and User Logout?

[Antony]

(This post is based on what I have learned and any feedback / further details would be most welcome!)

So I’ve had an issue with my app whereby if a user logs in and then does not use it for a while, when they come back to the app it no longer has a connection to the database and they believe the app to be broken.

Upon further investigation, I believe this is related to the PHP session timeout mechanism.
(Good article about this below).

The simple explanation of this is that with default settings, PHP session information (and therefore the user login information) can be lost from 24 minutes onwards after the user last executes a PHP based action.

(I think this is true, rather than from when they logged in and the session was started?)

So the question comes about how to handle this in our app?

Here are what I see as the issues:

Extending the 24 minutes
This needs to be done in the php.ini file on your server… see the article below for details

Elegantly handling this in your app
Here lies the challenge! Rather than having your app just malfunction once the session timeout occurs, you need a mechanism in your app to know that the timeout has occured and present the user with a message… This is discussed in a post I’ve found where @teodor suggests a solution (link below). I’ve yet to implement and try this.

MY QUESTION - How do you elegantly handle PHP Session Timeout in your app?
Do you have other methods you use?

Here are the references…

Handling The Timeout In Your App - Teodor’s solution

Auto Logout User on Session Expiry

Hi. I have a secure page which checks if user is logged in or not via App Security Provider Enforcer. It works well. I have not set any cookies or sessions to maintain user’s login session. Just the default PHP session timeout (30mins) is in play. So, if I refresh the page which has been idle, after say 45 mins, I am redirected to login page. Is there anyway I can redirect the page automatically after default PHP session times out?

PHP Session Timeout Article:
https://solutionfactor.net/blog/2014/02/08/implementing-session-timeout-with-php/

[bpj]

You could set a scheduler on the page for 24 +1sec mins that runs a SC to check for the logged in identity. If not there, redirect to login, display a message, give directions to the beer fridge… whatever you want.

If the user goes to another tab and comes back, it will run when they return.

The beauty of this is that if the user is using another tab which refreshes their session, it will find it and not trigger the action.