PHP : What is the default lifetime of a session

Question

If i hit a page which calls session_start(). How long would I have to wait, so that if i was to refresh the page, I was issued a new session ID?

Answer 1

Check out php.ini the value set for session.gc_maxlifetime is the ID lifetime in seconds.

I believe the default is 1440 seconds (24 mins)

http://uk2.php.net/manual/en/session.configuration.php

Answer 2

it depends on your php settings...
use phpinfo() and take a look at the session chapter. there are values like session.gc_maxlifetime and session.cache_expire and session.cookie_lifetime witch affects the sessions lifetime

EDIT: it's like Martin write before

Answer 3

The default in the php.ini for the session.gc_maxlifetime directive (the "gc" is for garbage collection) is 1440 seconds or 24 minutes. See the Session Runtime Configuation page in the manual:

http://www.php.net/manual/en/session.configuration.php

You can change this constant in the php.ini or .httpd.conf files if you have access to them, or in the local .htaccess file on your web site. To set the timeout to one hour using the .htaccess method, add this line to the .htaccess file in the root directory of the site:

php_value session.gc_maxlifetime "3600"

Be careful if you are on a shared host or if you host more than one site where you have not changed the default. The default session location is the /tmp directory, and the garbage collection routine will run every 24 minutes for these other sites (and wipe out your sessions in the process, regardless of how long they should be kept). See the note on the manual page or this site for a better explanation.

The answer to this is to move your sessions to another directory using session.save_path. This also helps prevent bad guys from hijacking your visitors' sessions from the default /tmp directory.