CODEWITHSUNDEEP
phpsession
Adam
Adam

Reputation: 20882

PHP + Logout Member when Session Expires

I've a site where people login and a SESSION is created.

I have noticed that if you leave the site for long enough (not sure exact time frame) the session ends but the members is still in the site. They can still click and navigate around and I believe this has resulted in some meaningless data in the DB as SESSION variables like userID don't exist.

I was looking for advice around logging users out when the SESSION ends. I have looked at code like this - any better ideas?

 <?php if(!isset($_SESSION[]) {header(loginpage.php);}?>

Is there a better way to write the above code?

Where should this code be placed? Just on the navigation menu or really on any place a user can click?

Finally is there a way to understand when the SESSION naturally expires - is there a SESSION variable I can print to screen to see the timeleft etc?

thanks

Upvotes: 0

Views: 1316

Answers (2)

Kelly Milligan
Kelly Milligan

Reputation: 588

I agree with the above answer. I would say it depends on how your application is architected to say where this belongs. before there is any output to the screen I am assuming your calling session_start, then immediately check for a session variable such as userID that gets set after a user logs in. if it's not set redirect setting a header for location to your login page. you could also write some js that checks the session cookie for a value at a specified interval(I believe, it's been a while so test it out), then when the variable isn't present you can redirect to the login page. a third way would be for the js code to make an XHR call to a php script to check out the session for you.

Upvotes: 0

hakre
hakre

Reputation: 197832

You need to validate the session, you already headed into that direction with your code, but it's not enough:

<?php if(!isset($_SESSION[]) {header(loginpage.php);}?>

It's not enough because $_SESSION[] exists automatically after the session is started (the session mechanism in PHP, see session_start).

Instead, if you have saved the userID inside the session, check that one:

isset($_SESSION['userID'])

If the session really expired, it should not be set.

Upvotes: 2

Related Questions