20
Late answering, but it's worth mentioning that you can use private tempstore for anonymous users, as long as the tempstore has access to an active session. To do so, you need to inject your class with services for the temp store, session, and current user, like so:
public function __construct(PrivateTempStoreFactory $temp_store_factory, ...
15
You can empty the sessions table using drush
drush sqlq "TRUNCATE sessions"
or if you have set prefixes for table names:
drush sqlq --db-prefix "TRUNCATE {sessions}"
15
The problem was ip_geoloc module. It was messing up $_SESSION variable, a solution is given on the issue queue (for now!) and the module author agrees with it. It's highly probable that it is happening because of a mis-configuration by me. The user was successfully logged in but immediately their session was invalidated. Somehow disabling it was not enough ...
14
In Drupal 8 the session variables can be accessed off the request:
$session = \Drupal::request()->getSession();
If you want to set something in the session, you can do the following:
$profile = 'Person';
$session->set('profile', $profile);
Or to retrieve a session variable:
$details = $session->get('profile');
12
You're looking for PHP's session_id():
session_id() is used to get or set the session id for the current session.
12
In D8 the session data is provided by a symfony session object, which is attached to the request. See this comparison of D7 against D8:
Drupal 7:
function mymodule_session_counter_increment() {
if (!isset($_SESSION['mymodule_count'])) {
$_SESSION['mymodule_count'] = 0;
}
return $_SESSION['mymodule_count']++;
}
Drupal 8:
class ...
7
Session variables seem to be the way to go
Don't forget that session variables rely on cookies
Have I missed any options?
The traditional solution would be to use the ip address as a fallback if cookies are disabled.
PHP does support an alternative to cookie-based sessions -- it can rewrite the URLs to include "?PHPSESSID=xyz". However, securing this ...
7
Okay, found the answer from this change record: https://www.drupal.org/node/2228871
The session can be force-started like this:
// Force session start if we don't already have a session.
$session = \Drupal::service('session');
if (!$session->isStarted()) {
$session->migrate();
}
7
The following code, let's login any user programmatically.
Not exactly; it sets the current global user object to an instance of a user, but it doesn't log the account in or touch the session. Many things that happen in that request that rely on the global user object will behave the same as if the account was logged in, but it won't be, and they won't have ...
6
Drupal 8 uses Symfony's HttpFoundation Session Management, so that's where the API is documented.
If you look in core.services.yml you can find that Drupal's wrapper is in.
session_manager:
class: Drupal\Core\Session\SessionManager
6
drupal_session_destroy_uid() sounds like a safe bet:
Ends a specific user's session(s).
The core implementation clears the database, as you'd expect, but any module that overrides session.inc, and doesn't provide a working implementation of that function, would surely be considered broken (as user_delete_multiple() and other functions need it).
So in ...
6
A session can be anonymous (uid=0). You can simply use $_SESSION and drupal will take care of this.
Store session data:
$_SESSION['mymodule']['variablename'] = $tempdata;
Get session data:
$tempdata = $_SESSION['mymodule']['variablename'];
Update 1: Session Object
While there is still work going on in D8 core, see this issue Convert uses of $_SESSION ...
6
I figured it out, but if someone posts a more in-depth answer, I'll accept it.
Drupal has a SessionHandler with a read function:
public function read($sid) {
$data = '';
if (!empty($sid)) {
// Read the session data from the database.
$query = $this->connection
->queryRange('SELECT session FROM {sessions} WHERE sid = :sid', ...
6
Seeing this has two votes, I'll try to explain it.
Drupal uses the built-in PHP session mechanism, which as you rightly suspect is based on a cookie. The cookie name is SESS followed by a long string of characters, and its value is another long string of characters. PHP detects this cookie and makes it available to Drupal's session implementation, which by ...
6
The main difference is that session data is stored in the database table sessions and PrivateTempStore in key_value_expire. Session data is preloaded in memory, private tempstore data only when requested. Session data is for small amount of data not exceeding a few megabytes, private tempstore for bigger chunks of data you don't want to have in memory when ...
5
What you are describing is not Drupal session vs. Browser session. There's just one session, always managed by Drupal (partially by using Symfony code. But it's still Drupal).
The (private) tempstore is just a custom storage that used to be provided by ctools in 7.x. For anonymous users, it actually requires a session to be present, as it uses the session ...
5
Configuring Garbage Collection
When a session opens, PHP will call the gc handler randomly
according to the probability set by session.gc_probability /
session.gc_divisor. For example if these were set to 5/100
respectively, it would mean a probability of 5%. Similarly, 3/4 would
mean a 3 in 4 chance of being called, i.e. 75%.
If the ...
4
It because drupal save session with key, this mean you should do something like
$_SESSION['yourkey']['xxx'] = serialize($data);
You can try this.
function lists_session($key, $value = NULL) {
global $user;
static $storage;
// If the user is anonymous, force a session start.
if(!user->uid) {
drupal_session_start();
}
if ($value) {
...
4
While waiting for an answer, I found the solution at this blog.
All you need to do is to edit the settings.php under /sites/default folder.
Here are the two variables that need to be set:
ini_set('session.gc_probability', 1);
ini_set('session.gc_divisor', 100);
Be sure to change also the cache expiry of the following variable according to your needs:
...
4
Drupal stopped tracking anonymous sessions a few versions ago. If you want to trick Drupal into doing it again you need to make a module with a custom hook_init() implementation.
/**
* Implements hook_init().
*
* <soapbox>The Drupal team decided to remove support for anonymous user sessions
* starting in Drupal 7.37. This fundamentally breaks ...
4
a quick google search: http://lmgtfy.com/?q=drupal+redis+sessions
and the 2nd result talks about redis session handling:
https://www.drupal.org/node/2250195
from that issue thread i recommend looking Session Proxy. This allows you to override the default session handler by Drupal -- which is explained in the above issue:
This is because Drupal will ...
4
What worked for me was enabling and configuring the $cookie_domain variable in settings.php (because I have a site that can be accessed by 2 different domains).
Pay attention to the comment before this variable! The domain name must start with a period. EX:
$cookie_domain = '.example.com';
Good luck!
4
We can achieve that using the Automated Logout module. combination of the Javascript Timer module.
Using the Automated Logout module we can set different timeouts for user roles and using Javascript Timer we can display remaining session time (countdown timer) for a logged in user.
Automated Logout
This module provides a site administrator the ability to ...
4
Don't dump session, cache_*, watchdog table content (make sure to keep the structure).
For watchdog there's syslog replacement.
If you don't need the access logging in Drupal disable that module and dump that table as well.
For huge content driven websites with lots of edits (and revisions) clearing the revision tables from time to time might help too. (e....
4
Session Limit allows to put restriction on session based on user role, it could be admin role also, with an exception that it does not restrict user with uid 1 which is kind of rescue point in case you misconfigure the module.
I would say instead of finding any module or building any custom solution which can put restriction on uid 1, you use different ...
4
Imlement hook_user_logout($account) and call user_cookie_delete($cookie_name).
For example:
function mymodule_user_logout($account) {
user_cookie_delete('name');
user_cookie_delete('mail');
user_cookie_delete('homepage');
}
4
TLDR
Look for session.gc_maxlifetime and session.cookie_lifetime.
Inspect your session cookies with browser developer tools
To debug this, one can use browser developer tools to inspect cookie expire date.
The cookie that is relevant for login has a key = "SESS...".
An "Expire" of "Session" means that the cookie expires when the browser is closed. Most ...
4
This is an issue with symfony/http-foundation v3.4.24. See https://www.drupal.org/project/drupal/issues/3045844.
3
This is a very old question, but I stumbled on it while having the same issue.
In my case, the "rewrite" Apache module was turned off. I re-enabled it with:
a2enmod rewrite
I could access /user, but could not login (it would loop back, with no error message). I assumed that since I could access /user, my rewrites and htaccess were OK. I could login with "...
3
You are looking for Automated Logout module.
This module provides a site administrator the ability to log users out
after a specified time of inactivity. It is highly customizable and
includes "site policies" by role to enforce logout.
Features
Different timeouts based on role
Disabling of timeouts based on role
Permission for users to set their own ...
Only top voted, non community-wiki answers of a minimum length are eligible