How can a PHP developer handle situations where a user forgets to log out in a system with a single user login?

When a user forgets to log out in a system with a single user login, a PHP developer can implement a session timeout feature to automatically log out the user after a certain period of inactivity. This can be achieved by setting a session variable with a timestamp when the user logs in, and then checking if the current time exceeds the allowed session duration. If it does, the user is automatically logged out. 

// Start the session
session_start();

// Set session timeout duration (in seconds)
$session_timeout = 1800; // 30 minutes

// Check if user is logged in
if(isset($_SESSION['logged_in']) && isset($_SESSION['last_activity'])) {
    // Check if session has timed out
    if(time() - $_SESSION['last_activity'] > $session_timeout) {
        // Destroy the session and log out the user
        session_unset();
        session_destroy();
        header("Location: login.php");
        exit();
    } else {
        // Update last activity time
        $_SESSION['last_activity'] = time();
    }
}

Keywords

session management logout functionality session timeout user authentication security vulnerability

Related Questions