I'm running a PHP + APACHE + CENTOS Linux combination.
I have implemented a login & logout on the website.
My question is, how can I know when the php session has timed-out (User has closed his browser without logging-out)?
The reason is, I want perform some cleanups and/or database updates (calling another PHP) when the user has done any of the following: (1) LOGGED-OUT or (2) TIMED-OUT
My guess is that I would have to make use of Apache/Linux, right?
Instead of detecting when the php session times out, you could create a script that will run at some semi regular interval (every 5 minutes say, using a crontab job most likely) that will log out/perform the clean up for anyone who hasn't been active in the last hour (or whatever your timeout value is) automatically. Just add a 'lastseen' to your user table.
You may store the session id in a database with a time stamp, and update the time stamp each time the user requests a webpage.
Then set a cron that looks at every "active" session, calculates the inactivity time and updates the session to "dead" (that may be done with a single SQL statment that runs periodically).
Also, modify your logout to update the session table and set the session to "dead".
Anyway, I don't think there are other ways to do this (with the "standard" PHP functions), but let's see what other people say.
I had the same problem, though with Lighty+PHP+Ubuntu. I think the problem is, that php does only react on page-requests, so there is no chance to get PHP raise an event on timeout.
You can override the session-store-functions in PHP but that won't help you either.
You could store the time of last event in the session though, and with every session started clean up old sessions that have run into timeouts. Not a very clean way, but the only working way I found.
If you keep the details of your sessions in a database table and log any activity you can easily check to see which sessions have been inactive for a specific time period.
Adding clean up functionality to user actions is going to slow down your website unnecessarily. A user should not have to wait for such actions to take place before getting a response from the server.
Instead, you could add the actions to be performed to a queue table, then use a CRON job to periodically check the queue table to see what needs to be done. The CRON syntax is listed here.