8

User is logged-in a PHP website > I restart Apache > User needs to log-in again.

How to prevent this? (I don't want user to need to log-in again)

3
  • To check: you have the ability to edit the PHP, right? Mar 12, 2012 at 15:01
  • If it's your own application I would suggest what @Jacob Hume below has suggested and change your application to store sessions in a database table. This gives you more control in my opinion over your site as you can force users to logout if needed selectively.
    – Anagio
    Mar 12, 2012 at 16:14
  • I can edit PHP. I'm using a CMS (Drupal). I'm also using APC and was looking for a solution in this way.
    – dowik
    Mar 13, 2012 at 8:13

3 Answers 3

6

Storing a session token in an alternate location as a backup would prevent this issue. You could still keep your main information in $_SESSION, but keep a backup token in:

  • Cookies
  • Database records
  • HTML5 Local Storage

You might find some help in this StackOverflow question: best practice for session timeouts and persistent login in php.

2
  • Thanks for the answer and thanks the link. I was looking for a solution on server side configuration file (kind of "keep sessions across restart"). But it seems that the solution is in the app side.
    – dowik
    Mar 13, 2012 at 8:16
  • Oh my... In fact I was simply looking for "apache2ctl -k graceful"!
    – dowik
    Mar 13, 2012 at 8:59
4

Your session data should not be lost just because Apache is shutdown or restarted unless the session data is being stored in memory and not backed up to disk (either by filesystem or database). Otherwise, you could restart the entire server and the session would still persist. Session data is designed to be stored long-term. The only time the session is lost is if:

  1. The SID is lost. The session data still exists server side, but the client is unable to recover the SID, so cannot reinitiate the same session. This can happen if the SID cookie expires (if it's a cookie) or the session links are lost (if the SID is a URL parameter) or the SID is unset server-side or changed without notifying the client.

  2. The session data is deleted server-side. This typically happens when the PHP Session Garbage Collector runs and sees the session file is older than session.gc_maxlifetime (which is 24 minutes by default). Otherwise, it can happen if the application explicitly deletes the session. On some servers, the administrator may also have configured a cronjob to clean out old session data on a regular basis.

4
  • Thank you for the details. I will investigate this way. But right now, I will simply use the graceful restart that's seem to fit my need.
    – dowik
    Mar 13, 2012 at 13:07
  • @dowik: How does a graceful restart fit your need? Is your problem lost sessions or interrupted downloads? If it's the latter, then graceful restart/shutdown will indeed solve that. But then you should edit your question to reflect that. Because graceful restarts have nothing to do with PHP sessions, and it will not help other users trying to prevent sessions from being lost. Mar 13, 2012 at 14:34
  • I have try to update the title of my question by replacing "PHP sessions" by "users sessions" like describe in the body of my question. Better for you? To be more precise : I use APC. When I change code in PHP files, I need to flush APC cache (restart Apache is the simplest way to do it I know). With "restart" argument, users of my website needs to log-in again. While with "graceful", they don't. That why "that's seem to fit my need".
    – dowik
    Mar 13, 2012 at 15:45
  • @dowik: I don't think that has anything to do with graceful restart. You most likely just had a restart that coincided with the PHP sessions garbage collector. Login again and try a regular restart immediately afterwards. Unless you're storing sessions in memory (MM), the session will be saved. Mar 13, 2012 at 19:21
1

Made possible by using the right argument with Apache :

apache2ctl -k graceful

Apache will restart without lose current sessions.

1
  • 2
    Graceful restart only postpones shutdown until current connections are terminated. It doesn't change the restart behavior. Mar 13, 2012 at 11:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.