$_SESSION remains when browser is closed

[jodleren]

Hi

I did not notice. A system I have made, seems on one server to keep
the $_SESSION even when the browser has been closed...
How can I avoid that?

WBR
Sonnich

[Jerry Stuckle]

jodleren wrote:

On Sep 2, 10:01 pm, Jerry Stuckle <jstuck...@attg lobal.netwrote:

>jodleren wrote:

>>Hi
I did not notice. A system I have made, seems on one server to keep
the $_SESSION even when the browser has been closed...
How can I avoid that?
WBR
Sonnich

You can't. PHP handles sessions via cookies. The browser may clear
cookies when it closes, or it may not. If not, you have no way of
determining whether the browser was closed or not.

Setting an expiration time helps. But it still doesn't stop someone
form closing the browser and reopening it before the session expires.

I tried - 30 minutes seems like 30 days. It can even remember it
overnight

Setting the session timeout correctly does work. How did you do it?

--
=============== ===
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
js*******@attgl obal.net
=============== ===

[jodleren]

On Sep 4, 3:08*pm, Jerry Stuckle <jstuck...@attg lobal.netwrote:

jodleren wrote:

On Sep 2, 10:01 pm, Jerry Stuckle <jstuck...@attg lobal.netwrote:

jodleren wrote:
Hi
I did not notice. A system I have made, seems on one server to keep
the $_SESSION even when the browser has been closed...
How can I avoid that?
WBR
Sonnich
You can't. *PHP handles sessions via cookies. *The browser may clear
cookies when it closes, or it may not. *If not, you have no way of
determining whether the browser was closed or not.

Setting an expiration time helps. *But it still doesn't stop someone
form closing the browser and reopening it before the session expires.

I tried - 30 minutes seems like 30 days. It can even remember it
overnight

Setting the session timeout correctly does work. *How did you do it?

session_cache_e xpire(60); // minutes
session_set_coo kie_params(60*$ ini_value['timeout']); //
session.cookie_ lifetime

both does not work - it still remembers.

I cannot access the php.ini, the provider does not allow that - I have
to contact them (www.nss.ee) to have it done. They claim that
register_global s is now false, but I cannot see the effect.
Instead I am changing the code in some places. But this problem here
remains.

WBR
Sonnich

[Jerry Stuckle]

jodleren wrote:

On Sep 4, 3:08 pm, Jerry Stuckle <jstuck...@attg lobal.netwrote:

>jodleren wrote:

>>On Sep 2, 10:01 pm, Jerry Stuckle <jstuck...@attg lobal.netwrote:
jodleren wrote:
Hi
I did not notice. A system I have made, seems on one server to keep
the $_SESSION even when the browser has been closed...
How can I avoid that?
WBR
Sonnich
You can't. PHP handles sessions via cookies. The browser may clear
cookies when it closes, or it may not. If not, you have no way of
determinin g whether the browser was closed or not.
Setting an expiration time helps. But it still doesn't stop someone
form closing the browser and reopening it before the session expires.
I tried - 30 minutes seems like 30 days. It can even remember it
overnight

Setting the session timeout correctly does work. How did you do it?

session_cache_e xpire(60); // minutes
session_set_coo kie_params(60*$ ini_value['timeout']); //
session.cookie_ lifetime

both does not work - it still remembers.

I cannot access the php.ini, the provider does not allow that - I have
to contact them (www.nss.ee) to have it done. They claim that
register_global s is now false, but I cannot see the effect.
Instead I am changing the code in some places. But this problem here
remains.

WBR
Sonnich

If you use them, both session_cache_e xpire() and
session_set_coo kie_params() must be called before EVERY session_start() .
Are you doing this?

And you can see the value of pretty much all of the settings in the
php.ini file with phpinfo().

And what's in $ini_value['timeout']?
--
=============== ===
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
js*******@attgl obal.net
=============== ===