What are some best practices for handling session expiration and maintenance in PHP?

Session expiration and maintenance in PHP can be handled by setting a reasonable session timeout value, checking for session expiration on each page load, and regenerating the session ID periodically to prevent session fixation attacks. 

// Set session timeout value to 30 minutes
session_start();
$session_timeout = 1800; // 30 minutes
if (isset($_SESSION['last_activity']) && (time() - $_SESSION['last_activity'] > $session_timeout)) {
    // Expire session if inactive for too long
    session_unset();
    session_destroy();
}
$_SESSION['last_activity'] = time();

// Regenerate session ID every 30 minutes
if (!isset($_SESSION['last_regenerated']) || (time() - $_SESSION['last_regenerated']) > $session_timeout) {
    session_regenerate_id(true);
    $_SESSION['last_regenerated'] = time();
}

Keywords

session expiration session maintenance PHP session handling security

Related Questions