Unexpected logout in Symfony 2.5 after interactive login - session

Question

After upgrade from 2.4.6 to 2.5 users get logged out every hour or two, though ttl is not that small. Switching back fixes the problem.
framework:
session:
name: SESSID
handler_id: session.handler.pdo
cookie_lifetime: 259200
Login is done with ajax.
$token = new UsernamePasswordToken($user, $user->getPassword()/* null */,
'main', $user->getRoles());
$this->get('security.context')->setToken($token);
$event = new InteractiveLoginEvent($this->getRequest(), $token);
$this->get('event_dispatcher')->dispatch(SecurityEvents::INTERACTIVE_LOGIN, $event);
Does anyone know about changes to symfony which could cause this? Or better and still simple way to log in?

Answer 1

I encountered this problem and I solved it by setting a value to gc_maxlifetime in config.yml. For that, I had a look to PdoSessionHandler.php and in the read method:
public function read($sessionId)
{
$this->beginTransaction();
try {
$this->lockSession($sessionId);
// We need to make sure we do not return session data that is already considered garbage according
// to the session.gc_maxlifetime setting because gc() is called after read() and only sometimes.
$maxlifetime = (int) ini_get('session.gc_maxlifetime');
$sql = "SELECT $this->dataCol FROM $this->table WHERE $this->idCol = :id AND $this->timeCol > :time";
$stmt = $this->pdo->prepare($sql);
$stmt->bindParam(':id', $sessionId, \PDO::PARAM_STR);
$stmt->bindValue(':time', time() - $maxlifetime, \PDO::PARAM_INT);
$stmt->execute();
// We use fetchAll instead of fetchColumn to make sure the DB cursor gets closed
$sessionRows = $stmt->fetchAll(\PDO::FETCH_NUM);
if ($sessionRows) {
return base64_decode($sessionRows[0][0]);
}
return '';
} catch (\PDOException $e) {
$this->rollback();
throw $e;
}
}
I looked especially these two lines:
$maxlifetime = (int) ini_get('session.gc_maxlifetime');
and
$stmt->bindValue(':time', time() - $maxlifetime, \PDO::PARAM_INT);
So, I have defined in config.yml:
session:
handler_id: session.handler.pdo
cookie_lifetime: 259200
gc_maxlifetime: 259200
I think that default php.ini value is taken for gc_maxlifetime if it is not defined (here $maxlifetime). So when user is inactive more than gc_maxlifetime, he is disconnected. cookie_lifetime will force user to be disconected after cookie_lifetime seconds.
PS: In Symfony 2.4 there was this code where gc_maxlifetime was not used:
public function read($sessionId)
{
$sql = "SELECT $this->dataCol FROM $this->table WHERE $this->idCol = :id";
try {
$stmt = $this->pdo->prepare($sql);
$stmt->bindParam(':id', $sessionId, \PDO::PARAM_STR);
$stmt->execute();
// We use fetchAll instead of fetchColumn to make sure the DB cursor gets closed
$sessionRows = $stmt->fetchAll(\PDO::FETCH_NUM);
if ($sessionRows) {
return base64_decode($sessionRows[0][0]);
}
return '';
} catch (\PDOException $e) {
throw new \RuntimeException(sprintf('PDOException was thrown when trying to read the session data: %s', $e->getMessage()), 0, $e);
}
}