Re: [Tiki-devel] Still can't stay logged in

On vendredi 13 octobre 2023 06 h 40 min 29 s EDT Jonny Bradley via TikiWiki-
devel wrote:
> Hi Oliver
> 
> I was thinking let's leave some set to php default and others (dev for now)
> on database and see if there's a difference?

Ah!  This caught my attention since it's been a big annoyance of mine in 
development.  This gave me the hint to of where to look to quickly look into 
it.

We have 3 session implementations ("memcache", "database" and "default").

"default" being the default php session handler, whose default timeout is at 
... 24 minutes.  

Now while we do set have code that sets PHP's session.gc_maxlifetime to tiki's 
session_lifetime pref, there is a problem:

The first comment on about setting session.gc_maxlifetime is still relevant to 
this day (on ubuntu 23.04, so probably debian and many other system):

https://www.php.net/manual/en/session.configuration.php#ini.session.gc-maxlifetime

So on many systems, if we use prefs.session_storage=default, unless we play 
with php defaults, the session will timeout after 24 minutes, and there is no 
way to change it without playing with PHP defaults.  Maybe it wont even change 
if we change it in things like webmin (if the external garbage collector 
doesn't know in which file to look for the active config).

I think we really should make prefs.session_storage=db the default.

And put a warning in the text for prefs.session_lifetime...



-- 
Benoit Grégoire