11

As far as I understand the session lifetime at Drupal is limited by session.gc_maxlifetime setting is by default set to some 2.3 days.

Then what is the use of session.cookie_lifetime being set to 23 days?

Here is the snippet from settings.php:

/**
 * Set session lifetime (in seconds), i.e. the time from the user's last visit
 * to the active session may be deleted by the session garbage collector. When
 * a session is deleted, authenticated users are logged out, and the contents
 * of the user's $_SESSION variable is discarded.
 */
ini_set('session.gc_maxlifetime', 200000);

/**
 * Set session cookie lifetime (in seconds), i.e. the time from the session is
 * created to the cookie expires, i.e. when the browser is expected to discard
 * the cookie. The value 0 means "until the browser is closed".
 */
ini_set('session.cookie_lifetime', 2000000);

Please assume that I've set both session.gc_probability and session.gc_divisor to 1 just for the sake of this question.

3
  • Because you don't want a cookie to disappear mysteriously? You want it to be there so the session can be invalidated gracefully? Is this causing any actual problem for you?
    – Mołot
    Jul 31, 2014 at 8:18
  • That's it then. But wouldn't it a better idea to make cookie expire at say 40 hours and server session at 51 hours? I mean cookie lifetime to be less than server expire time.
    – user5858
    Jul 31, 2014 at 9:09
  • This is largely opinion based and only PHP authors can really tell. Oh, and it depends on session handler you decided to use. But usually no, you don't want a session that's supposed to be active and usable for X more hours with no one to use it due to missing cookie. It's a waste of storage. Leaving cookie longer means that there almost always is someone who can use session data kept on server, so no session data kept is a waste.
    – Mołot
    Jul 31, 2014 at 9:17

1 Answer 1

18

ini_set('session.gc_maxlifetime', 200000);

  1. This value is for the server.
  2. It is a settings for Session Garbage Collection.
  3. If the users last visit happened before 200000s then this session is eligible for garbage collection.
  4. Since it is GC, the session value may be discarded and not compulsory. If a GC action happens after the session was made eligible for the GC, it will be deleted.
ini_set('session.cookie_lifetime', 2000000);
  1. This value is for the browser.

  2. This is the absolute maximum time till which a browser can keep this cookie active.

  3. A 0 value here means immediate or when the browser is closed.

To answer your question in particular.

  1. If the user doesn't hit the server back in 2.3 days, his session will be deleted when the session garbage collection runs.
  2. If he keeps on hitting one page on the server every 2.2 (less than 2.3 days) then his session will stay active. But it can be active only until 23 days from the time the session was first generated.
  3. So what that means is session.cookie_lifetime is the absolute maximum lifetime of a session.
2
  • 1
    Note the probabilistic garbage collector. More details: stackoverflow.com/a/1270960. Oct 30, 2015 at 18:48
  • Great answer, can also be done in php.ini if you have access to that on your server e.g. in /etc/php/5.6/fpm/php.ini adjust (or add) setting: session.gc_maxlifetime = 2000000. Thank you. May 23, 2017 at 10:27

Not the answer you're looking for? Browse other questions tagged or ask your own question.