Laravel user session lifetime expired

Level 48

@kailas bedarkar

If you use the default session driver 'file', the function 'gc' (/vendor/laravel/framework/src/Illuminate/Session/FileSessionHandler.php) checks if sessions are expired.

public function gc($lifetime): int
    {
        $files = Finder::create()
                    ->in($this->path)
                    ->files()
                    ->ignoreDotFiles(true)
                    ->date('<= now - '.$lifetime.' seconds');

        $deletedSessions = 0;

        foreach ($files as $file) {
            $this->files->delete($file->getRealPath());
            $deletedSessions++;
        }

        return $deletedSessions;
    }

Level 1

Hello @mvd, This code is called based on the lottery value mentioned in the session.php file. I've checked it's not called every time when session is cleared.

Level 122

the session just expires, ie, it is no longer valid by virtue of being past the end time. Each time the client sends in a request, the end time is extended to the full session lifetime.

in the case of file and database session storage, laravel runs a process to clear out old sessions on a lottery as part of the request cycle

If you are looking to run something the moment the session expires, then you are out of luck

Level 1

Hello @Snapey, Will the client send any request to the server to clear the session? means I like to know more about how laravel OR the sever clears the session & in laravel where it checks that the session is removed & redirected to the login page

axeloz

Level 2

@Kailas Bedarkar no, sessions aren't cleared by apps. Apps like Laravel define a expiration date and PHP process clears the expired sessions.

If you REALLY want to control when session are cleared, then you should clear it by yourself. Set a session time to 60 min and clear it yourself after 30m: you may add a AJAX request to run every 1 min to check the session status. Returns "true" if session is still alive. If time > 30 min, you clear the session and return "false".

mvd

Level 48

@Kailas Bedarkar see my first post. There the sessions will be deleted.

If you login, Laravel will check if the sessions exists. If the session not exists, you will be redirect to the login page.

Level 122

@Kailas Bedarkar no nothing is sent in either direction, and nothing is running on the server to expire the session

sr57

https://www.encodedna.com/javascript/redirect-page-after-a-delay-using-javascript.htm

Level 39

@mvd

Redirect with a javascript timer equal to the session life time

Level 122

what business problem are you trying to solve?

Level 1

@Snapey Before using auto logged out need to update the user login status.

Level 1

I've resolved this by increasing the session lifetime & in middleware I've to check when the user should be logged out minutes if use was in an idle state. For reference, I've resolved this by using "Yasin Patel" answer https://stackoverflow.com/questions/59031341/laravel-session-timeout-extra-logout-code

Thank you everyone for helping me

Level 122

@Kailas Bedarkar how will your middleware ever be hit if the user goes away?