i am working on a Cakephp 2.x ... i am using auth component ... the problem write now is that the session automatically expires after some minutes.. i mean if the user does nothing then CakePHP logs them out after some period...i want to make the session time forever unless he click the logout button ..i dont know how to to do this .. any help would be greatly appreciated
Here's my config code:
Configure::write('Session', array(
'defaults' => 'php'
));
I think the problem is that you're using the default php sessions and they are configured (in php.ini) to expire sooner than you want to. See.
If you want your logins to live forever it's probably better to use cookie based login. See this plugin for instance.
Related
I'm on Laravel 5.7 and trying to get it so that my session expires and logs me out after 2 minutes.
In my session.php file i did:
'lifetime' => 2,
'expire_on_close' => false,
I will then leave my computer for example like 15 minutes, come back, refresh, and I'm still logged in?
Can you tell me why and how to fix it. Many thanks.
Ok I've figured it out.
The reason is I'm using Auth::logoutOtherDevices in Login function, and this function automatically generates the remember me cookie.
Thank you guys so much.
update .env file
SESSION_LIFETIME=2
From the docs the lifetime looks like it is in seconds so the lifetime would be
SESSION_LIFETIME=120 and not 2.
Edit: Please could you try set the option:
'expire_on_close' => true,
This will force the session to expire on browse close.
I found a potential answer to your issue here: Laravel - Auth Session not expiring after browser close
It sounds like it could be a chrome problem.
Try your solution on firefox to see if it is a chrome issue.
Have a read of that thread i linked.
Please make sure to check with your configurations.
In Session.php set lifetime to your desired time for session expiration.
Also in upgraded versions of laravel session lifetime is not set hard anymore, instead it takes from .env file.
You can try below configurations.
In your config/session.php
'lifetime' => env('SESSION_LIFETIME', 2),
And set below key in your .env file
SESSION_LIFETIME=2
I have cakephp site, I was having problem that was after being idle for about >= 1 hour it gets log-out automatically
so I googled to extend timeout for that I wrote the following in core.php
Configure::write('Session', array(
'defaults' => 'php',
'timeout' => 28800, // 8 hours.
)
);
I want to keep a logged in user logged-in even after being idle for less than 8hours
but this is not working
how can I sort out this?
According to CakePHP manual, the unit of Session.timeout option is "minute", so 8 hours should be 60*8=480
Regarding the setting not work, I think maybe you could try to clean the cakePHP cache files / restart web server or change the debug level to 2 for troubleshooting?
CakePHP 2.0 manual sessions
May be you are using CakePHP 3, that is why you are facing this issue. Session timeout does not work in CakePHP 3, You might use cookie_lifetime, please check https://github.com/cakephp/cakephp/issues/5664
I had the same problem in CakePHP 1.3
The problem was that CakePHP was using the settings defined in php.ini instead of the one I was defining in core.php
So I had to change in core.php:
Configure::write('Session.save', 'php');
to
Configure::write('Session.save', 'cake');
And it worked like a charm!
Recently I moved my cakephp site from a hosting service to an other. The page was working like a charm, but now I'm having the issue, that my sessions randomly drop.
I'm on a shared hosting service, so I changed cake's session defaults from php to cake, now my sessions are saved to my tmp/sessions folder. (but it wasn't working with php either)
Followed my session's way with Firebug:
When i log into the page, i have a Sessionid, and in the tmp/sessions folder i have the corresponding sess_{sessionid} file too.
After a few clicks on some pages (totally random) my sessionid changes and i'm "logged out".
The session file with which i've logged in, remained in the directory.
My session settings in core.php right now:
Configure::write('Session', array(
'defaults' => 'cake'
));
I'm using the 2.3.8 version of Cake.
Update:
Finally i found the problem thanks to Nick. I checked the Cakephp error files, and found out that i only got logged out, when i visited a page containing an element, which was not on the server ( eg a picture was missing). So i went to Firebug, and check what the Net tab says. On the new Host service i got a 404 Not Found response AND a new session id set in the response, whilst on the other servers i tested the page, i simply got a 404 Not Found. If i randomly generate links to not existing files like (domain/test.jpg) i get the same results.
Try these settings, in Firefox you can install the web develop extension, then you can view your cookie to see if it is all set correct.
Configure::write('Session', array(
'defaults' => 'php',
'cookie' => 'yourdomain',
'timeout' => 44640,
));
Check any components that you are using for whitespace (usually at the end of the file).
I came across this recently whilst helping a client with their existing CakePHP site, when logged in one particular page that called a component was killing $this->Session->read(‘Auth’).
There is a CakePHP shell that you can use to find whitespace.
I need to keep Security.level set on medium for Ajax reason.
But I want that If the user close browser his session will destroy.
How can I do that?
Thanks in advance!
Config/core.php
Configure::write('Session', array(
'defaults' => 'php',
'cookieTimeout' => 0, //Lives until the browser is closed.
'checkAgent' => false //To fix a little the Chrome Frame problem
));
Unless you're persisting session data (ie: storing session data in a cookie with an expiration date in the future), then the session should be destroyed when the user closes the browser.
Unfortunately I'm not familiar with the CakePHP framework so I cannot comment on its API. However, if you want to explicitly end a session you can do so in PHP with session_destroy().
Hope that helps.
You could remove the session cookie with JS when the page is closed (remember: page close is also triggered when the user just navigates away - maybe just to the next page of yours).
i guess you could fire on ajax command on page unload to call session_destroy()
http://book.cakephp.org/view/1317/destroy for CakePHP - but yes, CakePHP does set a proper session cookie which is deleted by the browser when it closes.
What you really are probably concerned about is session hijacking - and so you really want some kind of a logout on site closure. You can't do this - the best alternative method that I know of is:
A short session timeout with an "Are you there?" AJAX refresh - the timeout can be controlled independently of the security level now using Configure::write('Session.timeout', $seconds);, where for medium security level the timeout seconds are multiplied by 100. Banks use this method.
My host requires me to use a different domain for SSL secured access (shared SSL), so I need to transition the user session between two domains. One part of the page lives at http://example.com, while the SSL'd part is at https://example.hosting.com. As such I can't set a domain-spanning cookie.
What I'm trying to do is to transition the session id over and re-set the cookie like this:
http://example.com/normal/page, user clicks link to secure area and goes to:
http://example.com/secure/page, which causes a redirect to:
https://example.hosting.com/secure/page?sess=ikub..., which resurrects the session and sets a new cookie valid for the domain, then redirects to:
https://example.hosting.com/secure/page
This works up to the point where the session should be resurrected. I'm doing:
function beforeFilter() {
...
$this->Session->id($_GET['sess']);
$this->Session->activate();
...
}
As far as I can tell this should start the session with the given ID. It actually generates a new session ID though and this session is empty, the data is not restored.
This is on CakePHP 1.2.4. Do I need to do something else, or is there a better way to do what I'm trying to do?
When Configure::write('Security.level') is set to medium or higher, session.referer_check is implicitly activated, which makes the whole thing fail. Setting the security level to low (or using a custom session configuration) makes everything work as it should.
There went about 5 hours of debugging... ( -_-;;)
My first thought is to use the Cake file sessions and copy the file over, and then perhaps try and start a new session with that phpsessid, although I'm not even sure if that would actually work or not :)
With Cake 2.6.1 -- This is what worked for me.
$this->Session->id("tfvjv43hjmsnjkh0v3ss539uq7"); // add session id you want to set
$this->Session->id();
$this->Session->read("key"); // hhoorray worked :)
with SessionComponent id() function needs to be called twice once with session id to set session_id(); and second time to start cake session.
First call does not really start the session ... I dont know how Cake Guys missed it .....
Upvote if this works for you.