Look for session.gc_maxlifetime and session.cookie_lifetime.
Inspect your session cookies with browser developer tools
To debug this, one can use browser developer tools to inspect cookie expire date.
The cookie that is relevant for login has a key = "SESS...".
An "Expire" of "Session" means that the cookie expires when the browser is closed. Most of the time this is not what you want!
You can open other Drupal sites (e.g. drupal.org) and compare the cookies. It can also be interesting to compare with other Drupal sites installed on the same server (e.g. your localhost), and with different browsers. This can give you clues whether this is a problem with your global server config or with your specific site.
Check current PHP config in Drupal
admin/reports/status/php for current phpinfo.
A value of session.cookie_lifetime === 0 causes the Expire === Session for the session cookie. This means that closing the browser causes a logout. Otherwise, the number specifies seconds of login duration.
See http://php.net/manual/en/session.security.ini.php for more information.
Inspect your code and server config
- ini_set() statements in your Drupal's sites/*/settings.php
- Your .htaccess file.
- Your server settings, e.g. in /etc/apache2/apache2.conf, or /etc/apache2/sites-enabled/... grep is your friend.
Also look for modules that modify login duration, such as https://www.drupal.org/project/autologout or https://www.drupal.org/project/autologout.
Decide on suitable values for session.gc_maxlifetime and session.cookie_lifetime, and use one of the places mentioned above to set these values.
For the project I am working on, I decided to set both values to 1209600 === two weeks.
(2 * 7 * 24 * 60 * 60 seconds === 1209600 seconds)
About the values
For more information on these values, see
From the information I found, and my understanding of it:
- session.gc_maxlifetime is a server-side limit, but session.cookie_lifetime is a client-side limit.
- Even when session.gc_maxlifetime has run out, there is a chance for the session to stay alive for a bit longer, because the garbage collection only happens every once in a while (depending on session.gc_probability and session.gc_divisor).
- A browser or other client could ignore or override the cookie lifetime, and keep the session alive longer than intended. I assume the expire date is also stored on server side, so I assume this won't help. See https://superuser.com/questions/442218/automatically-override-cookie-expiration-on-chrome where this is being discussed.