What are the potential security risks of not automatically logging out users in a PHP application?

If users are not automatically logged out of a PHP application, it can pose security risks such as unauthorized access to sensitive information if a user leaves their session open on a shared computer or forgets to log out. To mitigate this risk, it is important to implement an automatic logout feature that logs users out after a certain period of inactivity. 

// Check for user activity and log out after a certain period of inactivity
session_start();

// Set the inactivity timeout period (in seconds)
$inactive = 600; // 10 minutes

if (isset($_SESSION['timeout']) && time() - $_SESSION['timeout'] > $inactive) {
    session_unset();
    session_destroy();
    header("Location: logout.php");
}

$_SESSION['timeout'] = time();

Keywords

session hijacking unauthorized access CSRF attacks session fixation data leakage

Related Questions