Problem is, when my session expires I have to reload page twice to get back to login page. here is my .htaccess file
php_flag display_errors on
php_value error_reporting 9999
RewriteEngine On
Options -MultiViews
AddDefaultCharset UTF-8
php_value session.gc_maxlifetime 5
php_value session.gc_divisor 1
php_value session.gc_probability 1
php_value session.cookie_lifetime 5
php_value session.save_path /path/to/session/folder
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-l
RewriteRule ^(.+)$ index.php?url=$1 [QSA,L]
I'm using some custom MVC framework and I'm calling handleLogin() function in controllers __construct function
function __construct() {
parent::__construct();
Auth::handleLogin();
}
And finally here is handleLogin() function
public static function handleLogin() {
@session_start();
if (isset($_SESSION['loggedIn'])) {
$logged = $_SESSION['loggedIn'];
} else {
session_destroy();
header('location: ' . URL . 'login');
exit;
}
}
What do I need to change to redirect user to Login page after FIRST refresh when session expires?
Thanks in advance!
P.S. I'm running it on Debian
UPDATE: here is logout function and it works fine, when user clicks it he is immidiately redirected to login page
function logout()
{
session_destroy;
header('location: ' . URL . 'login');
exit;
}
UPDATE #2 I got some screenshots for better problem description
1) When session is active and everything works fine
2) session expired - user clicks link or refresh page (after first refresh) as you can notice in firebug login is loaded but it's not shown
3) after 2nd refresh
One more thing is.. when using default php.ini settings (session lifetime: 1440 sec) everthing works fine with no problem in redirecting
I found what caused error, but I'm not exactly sure why was it causing such a stupid bug. I had session_set_cookie_params(0);
earlier in my code, and while my browser was opened all the time i changed my code, removed session_set_cookie_params(0);
and added php_value session.gc_maxlifetime 5
. That's what caused conflict. One side expected session to last until browser closes and other side terminated session after 5 sec. I cleared my cache 100 times and nothing happened until i closed my browser and reopened project again.
I think you have to create a logout function where you have to write session destroy and then redirect. so when user clicks his logout link then you can destroy his session variables and then redirect to login page again.
If you are using ajax callback to destroy session then you have to refresh the page in javascript to redirect user to login page