everlasting sessions in PHP

Question

Is it possible to configure PHP sessions to never expire? I currently have the default 24 minutes set in php.ini - I could whack this up to a couple of weeks or something like that but I was wondering if I can set them to infinite lifetime?

I want to achieve a similar effect to Stackoverflow's: I never have to log in here. Is this achieved on SO with a never-expiring session or some other means?

Also, as a secondary question: How do the expired session files get cleaned up? If someone creates a session and never returns, which process is cleaning up their expired file?

Answer 1

Normally, what appears to be an everlasting session is two things: a session, which expires pretty soon, and a very long-life cookie containing an auto-login token.

There's a great series of responses on sessions and logging-in contained in this StackOverflow question: The Definitive Guide To Website Authentication

Regarding your question about when sessions are cleaned up, there are several php.ini settings for controlling when the garbage collection for sessions is triggered.

Answer 2

Since PHP both allows and encourages you to create your own session data storage handlers, there is no single correct answer to this question.

Answer 3

Answer to secondary question

Session file cleanup is controlled by the following 3 php.ini settings:

• session.gc_probability (default value 1)
• session.gc_divisor (default value 100)
• session.gc_maxlifetime (specified the age after which the session is considered as garbage)

First 2 settings specify the probability of the garbage collection process being started at session start (before or at the very beginning of your script execution, depending on how you have set things up)

In default configuration there is a 1% probability then that this happens. If it does, then files that are older than maxlifetime are cleaned.

As for your first question - why not write a custom session handler, that stores sessions inside the database (if you have one). That way you can see and control the sessions right from inside the database. Handy :)