2

On a site I am working on, I get logged out almost daily. I assume there is a limit on the login duration.

I already set session.gc_maxlifetime to a very high value, using ini_set() in settings.php. This setting is visible in /devel/phpinfo.

Is there anything else that limits the login duration?

EDIT: The original problem occured on a Drupal 7 site. But I imagine that the same problem and solution would apply in Drupal 8. Maybe someone wants to confirm this in the comments.

  • 1
    Could be any number of things really. Some contrib modules that do it for example: drupal.org/project/autologout, drupal.org/project/session_expire. There are probably more – Clive Oct 10 '17 at 12:38
  • It does not seem like any such module is enabled. (searched for "user", "login", "logout", "session", "duration", "limit" in module list) – donquixote Oct 10 '17 at 14:34
  • 1
    I think a good answer (as in useful for others) would be some kind of checklist. – donquixote Oct 10 '17 at 16:25
  • It seems this is because I use drush uli one-time login link instead of a regular user/pw login. The login cookie will then have Expires = Session, which means closing the browser causes a logout. – donquixote Oct 12 '17 at 15:07
  • That's a really interesting outcome would you mind putting an answer in to that effect? – Clive Oct 12 '17 at 15:08
3

TLDR

Look for session.gc_maxlifetime and session.cookie_lifetime.

Inspect your session cookies with browser developer tools

To debug this, one can use browser developer tools to inspect cookie expire date.

The cookie that is relevant for login has a key = "SESS...".

An "Expire" of "Session" means that the cookie expires when the browser is closed. Most of the time this is not what you want!

You can open other Drupal sites (e.g. drupal.org) and compare the cookies. It can also be interesting to compare with other Drupal sites installed on the same server (e.g. your localhost), and with different browsers. This can give you clues whether this is a problem with your global server config or with your specific site.

Check current PHP config in Drupal

Open admin/reports/status/php for current phpinfo. Look for session.cookie_lifetime and session.gc_maxlifetime.

A value of session.cookie_lifetime === 0 causes the Expire === Session for the session cookie. This means that closing the browser causes a logout. Otherwise, the number specifies seconds of login duration.

See http://php.net/manual/en/session.security.ini.php for more information.

Inspect your code and server config

  • ini_set() statements in your Drupal's sites/*/settings.php
  • Your .htaccess file.
  • Your server settings, e.g. in /etc/apache2/apache2.conf, or /etc/apache2/sites-enabled/... grep is your friend.

Also look for modules that modify login duration, such as https://www.drupal.org/project/autologout or https://www.drupal.org/project/autologout.

Fix.

Decide on suitable values for session.gc_maxlifetime and session.cookie_lifetime, and use one of the places mentioned above to set these values.

For the project I am working on, I decided to set both values to 1209600 === two weeks.
(2 * 7 * 24 * 60 * 60 seconds === 1209600 seconds)

About the values

For more information on these values, see

From the information I found, and my understanding of it:

  • session.gc_maxlifetime is a server-side limit, but session.cookie_lifetime is a client-side limit.
  • Even when session.gc_maxlifetime has run out, there is a chance for the session to stay alive for a bit longer, because the garbage collection only happens every once in a while (depending on session.gc_probability and session.gc_divisor).
  • A browser or other client could ignore or override the cookie lifetime, and keep the session alive longer than intended. I assume the expire date is also stored on server side, so I assume this won't help. See https://superuser.com/questions/442218/automatically-override-cookie-expiration-on-chrome where this is being discussed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.