I use a custom session handler which saves and reads session data from the database:
class c_session implements SessionHandlerInterface {
private $db; // Database
// Constructor
public function __construct($database){
$this->db = $database;
session_set_save_handler(
array($this, 'open'),
array($this, 'close'),
array($this, 'read'),
array($this, 'write'),
array($this, 'destroy'),
array($this, 'gc')
);
register_shutdown_function('session_write_close');
}
// Custom made session start
public function start_session() {
global $globals; // Included in config.php
// Make sure the session cookie is not accessible via javascript.
$httponly = true;
// Force the session to only use cookies, not URL variables.
ini_set('session.use_only_cookies', 1);
// Get session cookie parameters and set the parameters
$cookieParams = session_get_cookie_params();
session_set_cookie_params($cookieParams["lifetime"], $cookieParams["path"], $cookieParams["domain"], $globals['https'], $httponly);
// Change the session name
session_name($globals['session_name']);
// Now we can start the session
session_start();
}
...
In every web page, I read the session to check if the user has signed in:
function signin_check($db, $session) {
global $globals; // Included in config.php
$session->start_session();
try {
// Check if all session variables are set
if(isset($_SESSION['A'], $_SESSION['B'])) {
...
If she hasn't, she is logged out.
Variables $_SESSION['A']
and $_SESSION['B']
are set in the sign in page.
The systems works perfectly 99% of the time, but sometimes, when changing the web page, it logs you out randomly. This happens because both the $_SESSION['A']
and $_SESSION['B']
are unset without a (known) reason.
Why and how can I prevent these log-outs?
Either the session is timed out, as pointed out by @Rat in his/her comment or there is a code chunk which for some reason unsets $_SESSION["A"]
or $_SESSION["b"]
. Check which pages are those where this happens. If you can visit those pages without being logged out, but "sometimes" you are logged out, then there is a problem in your settings. Otherwise you should look into the code of the pages to see where they are logging you out.