My app is PHP based and follows the standard Wappler login procedure using the Security Provider and Security Login server action steps (shown below).
I would appreciate answers to the following questions to be sure I understand how this all works with regard to login timeout…
Is it true to say that if there is no activity by my app user after the time set by the session.cookie_lifetime variable in my php.ini file, then the login credentials will no longer be valid and further calls to server actions protected by the Security Restrict action step will fail?
If the above is true, what type of action needs to no longer be taking place to define “no activity by my app user”?
When you don't use the remember me option, as in your example:
a cookie won't be created.
I.e. the login will be kept for the current session (or until the browser is closed)
In your case, when the session time is 1440s then the user will be logged out after 1440s of inactivity. So if after that time passed, they try to refresh the page, navigate to another protected page it etc. they will be redirected to the login page defined in the security enforcer on the page.
If they try to run a server action after 1440s of inactivity, it won't run and will return an unauthorized error.
Thanks for your help on this back in September… I’m finally getting around to implement it!
Can you please clarify these questions for me…
If I use the Remember option in the Login Action, will all my server actions still work even if there is no user activity for much more than 1440 seconds?
If the answer to Question 1 is Yes, what value should I be putting in the Remember field?
I think i already answered this question a few months back:
Just enter a value, for example 1 or use a checkbox on the page with a value of 1 where users can select whether to stay logged in or not, after their browser is closed.
Thanks for your response. Yes, you did answer the question, and you will recall that in the following posts I said that i did not understand the response that you have just re-posted.
So please, just to be clear, is the answer to my question 1 yes, or no?
I’m really sorry, but I hope you can understand that your reply doesn’t make sense to me.
You often quite rightly ask on the forum here, “what do you want to achieve”… so let’s look at it in that way!
I want to implement a PHP login system which gives me the following functionality:
If the user logs in and leaves the browser window open, all server actions will function correctly for the following 8 hours, even if the app is not used for several hours of time within the 8 hour time window.
If the user logs out via a logout button I provide which does the Logout server action, they have to login in again.
If the user closes the browser tab, then they have to log in again.
My question is:
What combination of
Remember field in the login server action
Setting of session.gc_maxlifetime variable in php.ini file
