9

I'm having trouble setting the cookie lifetime in my D8 instance. I'd like to set it to zero so that closing the browser logs-off the user.

I've added ini_set('session.cookie_lifetime', 0); to the site/default/settings.php file. There was no previous cookie_lifetime reference in the file. I added the line. I've also cleared the Drupal cache and cleared my Chrome cache. Sadly, it's not being respected. Sessions still persist after browser close.

I've searched the entire codebase for ini_set('session.cookie_lifetime', 200000); but it doesn't appear to exist in my site. I don't see where Drupal is setting the cookie lifetime. I've also tried adding the setting via a php.ini file in the root but that's being over-ruled by Drupal.

I feel like this is a simple thing, so I'd like to avoid plugins. Looking forward to hearing from everyone. Thanks in advance.

17

For the session cookie options D8 uses container parameters instead of settings. Create a services.yml file in the same folder as settings.php. The default values are in default.services.yml. You can copy this file to services.yml and modify it:

/sites/default/services.yml:

parameters:
  session.storage.options:
    # Default ini options for sessions.
    #
    # Some distributions of Linux (most notably Debian) ship their PHP
    # installations with garbage collection (gc) disabled. Since Drupal depends
    # on PHP's garbage collection for clearing sessions, ensure that garbage
    # collection occurs by using the most common settings.
    # @default 1
    gc_probability: 1
    # @default 100
    gc_divisor: 100
    #
    # Set session lifetime (in seconds), i.e. the time from the user's last
    # visit to the active session may be deleted by the session garbage
    # collector. When a session is deleted, authenticated users are logged out,
    # and the contents of the user's $_SESSION variable is discarded.
    # @default 200000
    gc_maxlifetime: 200000
    #
    # Set session cookie lifetime (in seconds), i.e. the time from the session
    # is created to the cookie expires, i.e. when the browser is expected to
    # discard the cookie. The value 0 means "until the browser is closed".
    # @default 2000000
    cookie_lifetime: 2000000
  • 4k4, thanks very much. This is the solution we finally landed on. – Tony Stecca Sep 27 '16 at 18:37
  • Hi, maybe you know any way to do it dynamically? – Артем Ильин Apr 23 '19 at 8:58
  • 2
    @АртемИльин, you can't, the cookie options are compiled statically into the container. You can however swap the service session_configuration and override __construct or getOptions of Drupal\Core\Session\SessionConfiguration. – 4k4 Apr 23 '19 at 9:58
  • 4к4, many thanks for your answer, hope it helps) – Артем Ильин Apr 23 '19 at 10:49
  • Link to the follow up question drupal.stackexchange.com/questions/279292/… – 4k4 Jun 13 '19 at 16:50
-2

You would like to modify the cookies and session values you set #default values to the same values of session or cookies otherwise it will not work in drupal 8

**Ex : #default 0
gc_maxlifetime: 0**

parameters:
  session.storage.options:
    # Default ini options for sessions.
    #
    # Some distributions of Linux (most notably Debian) ship their PHP
    # installations with garbage collection (gc) disabled. Since Drupal depends
    # on PHP's garbage collection for clearing sessions, ensure that garbage
    # collection occurs by using the most common settings.
    # @default 1
    gc_probability: 1
    # @default 100
    gc_divisor: 100
    #
    # Set session lifetime (in seconds), i.e. the time from the user's last
    # visit to the active session may be deleted by the session garbage
    # collector. When a session is deleted, authenticated users are logged out,
    # and the contents of the user's $_SESSION variable is discarded.
    # @default 200000
    gc_maxlifetime: 200000
    #
    # Set session cookie lifetime (in seconds), i.e. the time from the session
    # is created to the cookie expires, i.e. when the browser is expected to
    # discard the cookie. The value 0 means "until the browser is closed".
    # @default 2000000
    cookie_lifetime: 2000000

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.