Sorry if this is long-winded:
I have the same site running on two servers (server_old & server_new). It's a hand-rolled PHP & Ajax thing I made for managing my inventory and loaning out equipment to customers. It has a basic login system that is similar to the one featured on this website: How to Create a Secure Login Script in PHP and MYSQL. So it uses PHP session variables to check whether you're logged in and forces you to the login page if not. I didn't implement any kind of mechanism to kick you out after so many minutes or hours, at least not intentionally.
Server_old is running Linux Mint 17 with Apache 2.4.7 & PHP 5.5.9, and server_new is running RHEL 7 with Apache 2.4.6 & PHP 5.4.16.
I've looked in the httdp.conf & php.ini of both systems and I can't figure out why:
When I'm logged into the site on server_old, my login seems to only be good for about 20 minutes of inactivity. This makes sense if gc_maxlifetime is affecting it. When I try to access a page after sitting idle that long, it'll redirect me to the login page. This is good for security of course, so no complaints.
Then I migrated the site and DB to server_new and I've been logged in with no activity for what seems like several hours and it's still good. I know it's been more than 2, and I'm pretty sure more than 3 hours. I can still manually log out and the site won't let me past the login page until I log back in, so that part is working.
I just can't figure out why I get logged out of the site on Mint after a few minutes and on RHEL my PHP sessions apparently last forever. Both servers have:
- session.cookie_lifetime = 0
- session.cache_expire = 180 (180 minutes)
- session.gc_maxlifetime = 1440 (1440 seconds / 24 minutes)
phpinfo() reports the same on both systems. However, on Mint the gc_probability is set to 0/1000 (essentially making it never collect the trash?) whereas on RHEL it's set to 1/1000. You'd think that never collecting the garbage and having cookie_lifetime = 0 would mean the session would last forever on Mint. But it's the opposite apparently.
Both Apache servers have been set with the same Timeout, KeepAlive, etc also.