Does Laravel log users off automatically after an interval? - laravel

Question

I'm new to Laravel and am using Laravel 6. I am working on an app that uses the default authentication for Laravel. I registered myself three times with three different email addresses for testing purposes. I'm finding that after a few hours, I'm logged off and have to log back in again even though I did not click on the logoff option.
Am I correct in assuming there is some kind of default timeout for IDs in Laravel? If so, how to change the interval or disable it altogether?
If that isn't the issue, what could account for me being logged out?

Answer 1

Laravel authentication uses session driver for web guard as default. You can check your default web guard's driver on config/auth.php.
'guards' => [
'web' => [
'driver' => 'session',
'provider' => 'users',
],
//...
],
The Laravel session's lifetime is 120 minutes by default, You can also check this default value on config/session.php as lifetime property.
'lifetime' => env('SESSION_LIFETIME', 120),
So you'll be logged off automatically (i.e your session expires) after 2 hours by default.
If you want to stay login for a long time, you have 2 options:
Select the "remember me" option when logging into your application (Recommended).
Set a large value (e.g 10 years or so) for session's lifetime on local .env file. It's not recommended on production environment, because not only authenticated users but also all visitors (including guest, bots etc.) would have a longtime session.
SESSION_LIFETIME=5256000 // 10 years

Answer 2

If you check CookieSessionHandler::write and CookieSessionHandler::read:
//write
/**
* {#inheritdoc}
*/
public function write($sessionId, $data)
{
$this->cookie->queue($sessionId, json_encode([
'data' => $data,
'expires' => $this->availableAt($this->minutes * 60),
]), $this->minutes);
return true;
}
//read
/**
* {#inheritdoc}
*/
public function read($sessionId)
{
$value = $this->request->cookies->get($sessionId) ?: '';
if (! is_null($decoded = json_decode($value, true)) && is_array($decoded)) {
if (isset($decoded['expires']) && $this->currentTime() <= $decoded['expires']) {
return $decoded['data'];
}
}
return '';
}
you can see that there must be some value of time to compare with current time value. Otherwise an empty string is returned and session is being invalidated. Best way you can do is to set config value to something really large (e.g. 35791394 [~68 years in minutes]) This is fail safe for 32-bit systems because it is 2147483640 which is less than signed 32-bit MAX_INT value 2147483647, just in case. Even if sometimes in future Laravel rewrite session lifetime to use seconds instead of minutes this will last for more than a year.
Another SO answer.