8

I'm using codeigniter for my app

what my problem is session is expiring even though user is active on the site.

These are the session settings.. i'm using DB session

$config['sess_cookie_name']     = 'ci_session';
$config['sess_expiration']      = 7200;
$config['sess_encrypt_cookie']  = FALSE;
$config['sess_use_database']    = TRUE;
$config['sess_table_name']      = 'edu_sessions';
$config['sess_match_ip']        = FALSE;
$config['sess_match_useragent'] = TRUE;
$config['sess_time_to_update']  = 300;

any solution for this.

help me i have to fix it

here is the codeigniter forum link

2
  • Are you positive that the sessions are being saved to the database correctly? Jul 28, 2011 at 14:18
  • I Don't know, But when i'm using more data in session if the dbsession option is enabled then only session working, otherwise its not working
    – nani1216
    Aug 2, 2011 at 7:23

7 Answers 7

12

I've had issues with CI sessions expiring randomly. Do you have AJAX or dynamic resources loading the session library? If so, imagine this scenario:

I submit an ajax request (which passes in my CI session id with the cookie), and it returns the results, BUT I'm also submitting some other request (loading a dynamic image, another AJAX request, etc.) that immediately follows the first request. The first request might trigger the 300 second "it's time to update" event, and pass back a new cookie, but the additional request is sending the old session id, right?

So, CodeIgniter says "hey you, you can't do that" and creates a new session, invalidating both cookies my browser now doesn't know what to do with.

Here's a forum link I posted a while back that goes into more detail: http://codeigniter.com/forums/viewthread/172415/

10
  • Thanks landons. my application has many dynamic ajax call like what you explained. If you have solution for this please let me know. this is a serious issue in my application. Thanks
    – nani1216
    Nov 27, 2011 at 13:58
  • I'd extend the Session class, and write your own sess_destroy function that checks the INPUT::is_ajax_request() function to prevent normal session expiration for ajax requests. Keep in mind that the sess_read function will return FALSE every time it calls the sess_destroy() function, so you'll need to override that too. Want a working example?
    – landons
    Nov 29, 2011 at 20:25
  • Ya, give me a working example, so that i can do it quickly. Thanks
    – nani1216
    Dec 6, 2011 at 8:28
  • Hi @landons, seems the link you posted is dead, do you have a working example or another link to what you are describing above that works on CI 2.2-stable? I've gotten the latest as of today, and the session is still being destroyed almost 3 years later.
    – mtpultz
    Nov 27, 2014 at 11:03
  • @mtpultz, I don't, but my "fix" on current CI projects is to set the session rotation interval to the same value as the session expiration config. Keep in mind that it's not a good fix for high-profile, highly security-conscious projects
    – landons
    Nov 29, 2014 at 0:09
3

As mentioned in the first answer, there is a race condition in the session library which has since been somewhat mitigated in the latest versions of CodeIgniter, including the 'develop' branch. This implements an isAjax check on session rotation, but it doesn't really fix the underlying problem.

3

are you sure that the session is destroyed? I think that it's just not getting updated as supposed and it creates a new one on every page request. (common Codeigniter's setting issue)

here's my suggestions:

double check your Application/Config/config.php file to ensure that the part of session domain looks like that if you host the site on the main directory:

$config['cookie_prefix']    = "";
$config['cookie_domain']    = "yourdomain.com";
$config['cookie_path']  = "var/sessions/";
$config['cookie_secure']    = FALSE;

and like that if you host the site on a sub-directory:

$config['cookie_prefix']    = "";
$config['cookie_domain']    = "yourdomain.com";
$config['cookie_path']  = "siteSubDirectory/var/sessions/";
$config['cookie_secure']    = FALSE;

and also make sure that the 2 directories are writable by fixing their permissions to 755 or so, and I strongly recommend that you enable database session, it's more secure and will help you find out the real problem by checking the session table. good luck :)

3

I will add a workaround for this issue. if an ajax call is made then do not update the session extend the session class by adding this file to the libraries folder:

    class MY_Session extends CI_Session {

    // --------------------------------------------------------------------

    /**
     * sess_update()
     *
     * @access    public
     * @return    void
     */
    public function sess_update()
    {
        $CI =& get_instance();

        if ( ! $CI->input->is_ajax_request())
        {
            parent::sess_update();
        }
    }

}
1

Just change ci_sessions table encode to MyISAM: ALTER TABLEci_sessionsENGINE = MyISAM;

1
  • 1
    this is what i need, do you know why not work for InnoDB? Thanks!
    – Jawaad
    Dec 8, 2014 at 1:10
0

Remove bellow line from config.php

$config['cookie_path']      = '/';
0

You may need to set the cookie domain in ,/application/config/config.php

  PHP Code:
    $config['cookie_prefix']   = '';
    $config['cookie_domain']   = '.domainname.com';
    $config['cookie_path']     = '/';
    $config['cookie_secure']   = FALSE;
    $config['cookie_httponly'] = FALSE;

cookie_domain as your host name, this resolve my session expire issue

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.