0

I only want users to logout if they visit the "logout" page. For this I set this in my settings file:

ini_set('session.gc_maxlifetime', 0);
ini_set('session.cookie_lifetime', 0);

But users are still disconnecting from site from time to time and I don't know why. Is there a better way to tell site to not log out users? What is causing users to be disconnected?

EDIT: I have users that launch site from browser and that launch site through mobile application by rest service(services module). Both types of users are disconnects. I not sure but sometimes when I save some views user is logging out and I recieve message that you have no access.

UPDATE: this part of code ini_set('session.gc_maxlifetime', 0); logs out user. I thought that if it set to 0 it means that user has never been loging out until he not push on logout.

  • Server restarts will cause the loss of sessions eventually. So if the server is restarted via cron job for instance, this might be the culprit. – Paul Oct 7 '14 at 12:21
  • This is not my case. – FriOne Oct 7 '14 at 12:28
  • There are dozens things that can logout your users. Can you tell us which one affects your site? – Mołot Oct 7 '14 at 13:07
  • @Mołot, edited my question, maybe this will help. – FriOne Oct 7 '14 at 16:39
0

Is there a better way to control user's login sessions? Yes.

There's a great module (beta since 2012, 1,000+ active sites used it as of October 1, 2014): https://www.drupal.org/project/persistent_login

From the module page:

The Persistent Login module provides the familiar "Remember Me" option in the user login form. Additional security is provided by using two tokens (one long-running, one per access) that allow the detection of unauthorized token use.

Persistent Login is independent of the PHP session settings and is more secure (and user-friendly) than simply setting a long PHP session lifetime. For a detailed discussion of the design and security of Persistent Login, see Improved Persistent Login Cookie Best Practice.

What is causing the users to be disconnected? Depends.

As Mołot pointed out, there are literally dozens of things that could be happening. For example, we could be talking about multiple browsers, multiple devices, or someone who regularly clears out their cookies and internet history. Most of these situations are out of your control. The standard Drupal session cookie usually keeps me logged in over the course of a day or two without having to re-login. If someone is getting logged off in the same 24 hours span, something is happening.

  • Tommorow I will look at this module but I not sure, does this module will help me if I have users that looging in with service module through rest API? – FriOne Oct 7 '14 at 16:41
  • That would have been helpful in the original question. REST api sessions throw up all kinds of "I have no idea" flags. try out the module and see if it solves your problem. Otherwise, you're going to have to do a lot of debugging to see how the cookies/sessions get treated on a third-party app. – joshmiller Oct 7 '14 at 16:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.