You should implement a session timeout of your own. Both options mentioned by others (session.gc_maxlifetime and session.cookie_lifetime) are not reliable. I'll explain the reasons for that.
First:
session.gc_maxlifetime
session.gc_maxlifetime specifies the number of seconds after which data will be seen as 'garbage' and cleaned up. Garbage collection occurs during session start.
But the garbage collector is only started with a probability of session.gc_probability divided by session.gc_divisor. And using the default values for those options (1 and 100 respectively), the chance is only at 1%.
Well, you could simply adjust these values so that the garbage collector is started more often. But when the garbage collector is started, it will check the validity for every registered session. And that is cost-intensive.
Furthermore, when using PHP's default session.save_handler files, the session data is stored in files in a path specified in session.save_path. With that session handler, the age of the session data is calculated on the file's last modification date and not the last access date:
Note: If you are using the default file-based session handler, your filesystem must keep track of access times (atime). Windows FAT does not so you will have to come up with another way to handle garbage collecting your session if you are stuck with a FAT filesystem or any other filesystem where atime tracking is not available. Since PHP 4.2.3 it has used mtime (modified date) instead of atime. So, you won't have problems with filesystems where atime tracking is not available.
So it additionally might occur that a session data file is deleted while the session itself is still considered as valid because the session data was not updated recently.
And second:
session.cookie_lifetime
session.cookie_lifetime specifies the lifetime of the cookie in seconds which is sent to the browser. […]
Yes, that's right. This only affects the cookie lifetime and the session itself may still be valid. But it's the server's task to invalidate a session, not the client. So this doesn't help anything. In fact, having session.cookie_lifetime set to 0
would make the session’s cookie a real session cookie that is only valid until the browser is closed.
Conclusion / best solution:
The best solution is to implement a session timeout of your own. Use a simple time stamp that denotes the time of the last activity (i.e. request) and update it with every request:
if (isset($_SESSION['LAST_ACTIVITY']) && (time() - $_SESSION['LAST_ACTIVITY'] > 1800)) {
// last request was more than 30 minutes ago
session_unset(); // unset $_SESSION variable for the run-time
session_destroy(); // destroy session data in storage
}
$_SESSION['LAST_ACTIVITY'] = time(); // update last activity time stamp
Updating the session data with every request also changes the session file's modification date so that the session is not removed by the garbage collector prematurely.
You can also use an additional time stamp to regenerate the session ID periodically to avoid attacks on sessions like session fixation:
if (!isset($_SESSION['CREATED'])) {
$_SESSION['CREATED'] = time();
} else if (time() - $_SESSION['CREATED'] > 1800) {
// session started more than 30 minutes ago
session_regenerate_id(true); // change session ID for the current session and invalidate old session ID
$_SESSION['CREATED'] = time(); // update creation time
}
Notes:
session.gc_maxlifetime
should be at least equal to the lifetime of this custom expiration handler (1800 in this example);
- if you want to expire the session after 30 minutes of activity instead of after 30 minutes since start, you'll also need to use
setcookie
with an expire of time()+60*30
to keep the session cookie active.
In order to use mod_rewrite
you can type the following command in the terminal:
sudo a2enmod rewrite
Restart apache2 after
sudo /etc/init.d/apache2 restart
or
sudo service apache2 restart
or as per new unified System Control Way
sudo systemctl restart apache2
Then, if you'd like, you can use the following .htaccess
file.
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
The above .htaccess
file (if placed in your DocumentRoot
) will redirect all traffic to an index.php
file in the DocumentRoot
unless the file exists.
So, let's say you have the following directory structure and httpdocs is the DocumentRoot
httpdocs/
.htaccess
index.php
images/
hello.png
js/
jquery.js
css/
style.css
includes/
app/
app.php
Any file that exists in httpdocs will be served to the requester using the .htaccess
shown above, however, everything else will be redirected to httpdocs/index.php
. Your application files in includes/app
will not be accessible.
Best Answer
KeepAlive
is not linked to session timeouts on weblogic.The
KeepAlive
in the apache server is for improved performance by using a reusable pool of connections from the Apache plug-in to the WebLogic Server. If the connection is inactive for more than 30 seconds, (or a user-defined amount of time) the connection is closed and returned to the pool.Still it is recommended to set KeepAlive ON and set the KeepAliveSecs 15 as default.
Now on to your main problem of enabling a 2 hour session timeout. Note: 2 hours is a high amount (the default is only 30 mins) and your Weblogic servers will be using up more memory keeping the session details alive.
I assume you are relying on Apache to direct to the correct Weblogic server based on the user's JSESSIONID. In that case - Apache will send the request to the correct Weblogic server in your cluster - and the user's session will stay alive on that server. Unless you switch on session replication which is another memory hogger.
But to answer your question, your 120 minutes should be respected based on the
<session-timeout>
setting in web.xml It is also possible to set this in weblogic.xml, but the overriding one is web.xml