How does the Drupal session system work?

Question

I would like to implement the familiar "Remember me" functionality on user login forms, i.e. if a registered user leaves the browser without hitting the log out link, (s)he will still be logged in when visiting the website afterwards. A quick search leads to the Remember me module, whose description states:

(...) the default Drupal behaviour is to remember your session for the extent of 3 weeks and 2 days. (...) Can you imagine the colossal risk this places on users accessing your service from public terminals or shared workstations, with no means to their disposal of securing themselves against this threat.

If the first sentence is true, it seems that I do not need the module to accomplish my need. Indeed, I can safely exit Firefox without loosing my session for "a while" (I do not know the exact time interval). However, other users on my website complain that they are immediately logged out after closing their browser.

So now I want to know the ins and the outs of the matter. Are sessions handeled differently for different browsers and, if yes, why? Does Drupal remember sessions for the extent of 3 weeks and 2 days and, if yes, why was this long time interval chosen? Is not using a module like Remember me indeed a risk?

Answer 1

Drupal has a pluggable session handler, however it generally uses a cookie + database session model by default.

The sessions table in the database stores the session details for the users. The session id is stored and matched from a browser cookie.

The settings for session duration can be found in settings.php, in particular:

/**
 * Set session lifetime (in seconds), i.e. the time from the user's last visit
 * to the active session may be deleted by the session garbage collector. When
 * a session is deleted, authenticated users are logged out, and the contents
 * of the user's $_SESSION variable is discarded.
 */
ini_set('session.gc_maxlifetime', 200000);

/**
 * Set session cookie lifetime (in seconds), i.e. the time from the session is
 * created to the cookie expires, i.e. when the browser is expected to discard
 * the cookie. The value 0 means "until the browser is closed".
 */
ini_set('session.cookie_lifetime', 2000000);

You can adjust those settings to affect the session lifetime. Indeed, the "remember me" module uses the session.cookie_lifetime setting to apply its functionality.

Answer 2

However, other users on my website complain that they are immediately logged out after closing their browser.

They should not be, unless they have history set to Never remember history/cookies or they use an app/extension that clears the history/cookies when the browser is closed.

So the cause of the problem is really on their end.

You could use IP Login so they get logged in automatically.