Path: csiph.com!eternal-september.org!feeder.eternal-september.org!news.mb-net.net!open-news-network.org!.POSTED.40.232.197.178.dynamic.wless.lssmb00p-cgnat.res.cust.swisscom.ch!not-for-mail From: Thomas 'PointedEars' Lahn Newsgroups: comp.lang.php Subject: Re: php ini Date: Wed, 16 May 2018 19:59:45 +0200 Organization: PointedEars Software (PES) Lines: 94 Message-ID: <13761023.FnKYLD8mAL@PointedEars.de> References: <1731736.ES7vfGFGlS@PointedEars.de> Reply-To: Thomas 'PointedEars' Lahn Mime-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 8Bit Injection-Info: gwaiyur.mb-net.net; posting-host="40.232.197.178.dynamic.wless.lssmb00p-cgnat.res.cust.swisscom.ch:178.197.232.40"; logging-data="28261"; mail-complaints-to="abuse@open-news-network.org" User-Agent: KNode/4.14.2 X-Face: %i>XG-yXR'\"2P/C_aO%~;2o~?g0pPKmbOw^=NT`tprDEf++D.m7"}HW6.#=U:?2GGctkL,f89@H46O$ASoW&?s}.k+&. Thomas 'PointedEars' Lahn wrote: >> Lew Pitcher wrote: >>> You are looking for the "session.cookie_lifetime" setting in php.ini >> >> Not necessarily. Because that setting is not the only one that controls the availability of session information. >>> […] >>> http://php.net/manual/en/session.configuration.php >>> >>> [snip] >>> >>> FWIW, this is a global php setting; >> >> It does not have to. > > Yes, it does. > > You can /override/ the setting, but that takes a deliberate act. I would assume that depends on how the PHP executable is compiled. >>> if you have multiple pages, >> You mean Web _sites_. > > No, I mean multiple pages. First of all, *there* *are* *no* (*Web*) *pages*. Get rid of that outdated concept NOW. Second, it is a bad idea for different parts of the same Web site to have different session lifetimes, unless they are part of distinct applications that are presented as such to the user. Even then, users usually expect a Web site, and in a broader context, a Web application as a service to other Web resources, to work consistently throughout. If the session is the result of a login process, they will not appreciate that this session times out earlier in one section of the Web site or one feature of the Web service than in another. >>> each with their own session criteria, you can override this default by >>> passing the appropriate value in the session_start() call. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ >> (They said that they do not want to do it in code.) > > Yes, so? So this particular suggestion is the exact opposite of what the OP is looking for. (Is that not blatantly obvious?) One valid reason why one would not want to do it in code is that the code must not or is not supposed to be modified. > My answer stands: use the "session.cookie_lifetime" setting in > php.ini If one does that, then that affects all parts of all sites hosted on the same (virtual) server. Bad idea, and often not even possible as prevented by administrative locks. >> Provide an additional configuration (file) for each site instead. > > What sort of "configuration (file)"? This setting and many other session-related settings have a changeable mode of PHP_INI_ALL, which means that they can be set in php.ini and in PHP source code, but also in httpd.conf (including the virtual host configuration), and per directory in a .htaccess or .user.ini file (therefore, “file” in parentheses). > And, how do /you/ control separate sessions per page (yes, you /can/ do > that)? That depends on what *you* mean by “page”. This term is underdefined at best. For different dynamically generated Web documents, that belong to the same application, I would not do it. For distinct applications, using different session.save_path, which also can be be set in one of the ways that I described above; preferably _not_ in php.ini or code. In fact, different session directiories is the recommended approach, so that different sessions of different applications on the same server do not interfere, can expire, be garbage collected, and be reset manually if necessary, independently. -- PointedEars Zend Certified PHP Engineer | Twitter: @PointedEars2 | Please do not cc me./Bitte keine Kopien per E-Mail.