Users logouts from time to time

Question

I only want users to logout if they visit the "logout" page. For this I set this in my settings file:

ini_set('session.gc_maxlifetime', 0);
ini_set('session.cookie_lifetime', 0);

But users are still disconnecting from site from time to time and I don't know why. Is there a better way to tell site to not log out users? What is causing users to be disconnected?

EDIT: I have users that launch site from browser and that launch site through mobile application by rest service(services module). Both types of users are disconnects. I not sure but sometimes when I save some views user is logging out and I recieve message that you have no access.

UPDATE: this part of code ini_set('session.gc_maxlifetime', 0); logs out user. I thought that if it set to 0 it means that user has never been loging out until he not push on logout.

Answer 1

Is there a better way to control user's login sessions? Yes.

There's a great module (beta since 2012, 1,000+ active sites used it as of October 1, 2014): https://www.drupal.org/project/persistent_login

From the module page:

The Persistent Login module provides the familiar "Remember Me" option in the user login form. Additional security is provided by using two tokens (one long-running, one per access) that allow the detection of unauthorized token use.

Persistent Login is independent of the PHP session settings and is more secure (and user-friendly) than simply setting a long PHP session lifetime. For a detailed discussion of the design and security of Persistent Login, see Improved Persistent Login Cookie Best Practice.

What is causing the users to be disconnected? Depends.

As Mołot pointed out, there are literally dozens of things that could be happening. For example, we could be talking about multiple browsers, multiple devices, or someone who regularly clears out their cookies and internet history. Most of these situations are out of your control. The standard Drupal session cookie usually keeps me logged in over the course of a day or two without having to re-login. If someone is getting logged off in the same 24 hours span, something is happening.