3

Recently, I've been getting logged out sooner than expected on several websites that I manage on Linux servers. The problem started spontaneously a few months ago. At the time, I had not made any recent changes to the website code or the CPanel settings. There was no need to, because my CPanel settings always kept me logged in for about 18 hours. But now I'm getting logged out after just 30 minutes of inactivity. Here are the CPanel settings that worked reliably until a few months ago:

session.cookie_lifetime 0
session.gc_maxlifetime 65535

For troubleshooting, I've also tried the equivalent settings in the htaccess file:

php_value session.cookie_lifetime 0
php_value session.gc_maxlifetime 65535

(65535 seconds is equivalent to about 18 hours.)

I've tested this problem with three different PHP forms. First, I log in with a user name and password. If I then press F5 to refresh within 30 minutes, I am still logged in. But if I wait longer than 30 minutes before refreshing the page, I find that I have been logged out. Also, I've tried two different servers provided by the same web host, but the problem remains.

I'm on a shared CentOS server, and I don't have access to the php.ini file -- only the CPanel and .htaccess file.

I suspect this problem has been caused by a recent Linux / CentOS update, but I don't see similar complaints on the internet. So I wonder if it's just my web host. (They are otherwise very reliable.)

Has anyone encountered this problem? Is it a Linux / CentOS bug? Is there a fix? Or should I move to another web host?

Improve this question
4
  • Is the server date & time correct?
    – Tim Fountain
    Aug 7, 2017 at 22:18
  • Yes, I've confirmed just now that the server date and time are correct and synchronized. Thanks.
    – Photon
    Aug 7, 2017 at 22:39
  • Is it "exactly" 30 minutes? It's just that the default value for session.gc_maxlifetime is 1440 seconds (ie. 24 minutes). Check the value after you've set it, or check php_info() afterwards. Note also, that if another script is setting a lower value (for the same session handler) then that is likely to win.
    – MrWhite
    Aug 7, 2017 at 22:56
  • Just now, I've refreshed after 27 minutes of inactivity, and I am still logged in. But even if session.gc_maxlifetime is 1440 seconds in the global php.ini file, the session might not expire at exactly that time, afaik. So you might still be right. In any case, whatever the global php.ini setting is, my cPanel setting should be overriding it, but I don't think that is happening.
    – Photon
    Aug 7, 2017 at 23:35

1 Answer 1

Reset to default
2

Thanks for the trouble-shooting help. I have solved the problem -- by specifying a custom folder for storing temporary session data. Here's how:

  1. Locate the folder where your session data files are currently being stored. In my case, the folder was called tmp. The folder name and location may vary, depending on your version of Linux and how it has been set up, afaik.

  2. Create a new folder, located in the same folder as the tmp folder (not within the tmp folder).

  3. In cPanel (php version / PHP Selector | options), specify the full path to the new folder as the value for session.save_path. You can also do this in your php.ini file, if you have access to it.

If you need more information, the following links might be helpful:

https://security.stackexchange.com/questions/19053/where-and-how-is-data-stored-in-a-session

https://stackoverflow.com/questions/4927850/location-for-session-files-in-apache-php

https://docs.cloudlinux.com/index.html?tmp_directories.html (CloudLinux Documentation: Tmp Directories)

I hope this helps anyone who encounters the same problem in the future.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.