5

I've set 'lifetime' => 10 in my session config file, but it doesn't expire at all.

In laravel 3 with that setting, after logging in, when limit of 10 minutes is exceeded, the session expires properly and user is redirected to login again.

In laravel 4 it doesn't happen. After 10 minutes I can refresh, do anything and still session is valid.

I'm testing both on the same machine with analogical settings... What am I missing?

1
  • I don't know what is wrong with your application, but session lifetime is working with me. If your session driver is file, make sure that it has write access to app/storage folder. For quick test, you can try with 'lifetime' => 1 instead of 10 minutes.
    – Khay
    Commented Jun 26, 2014 at 11:10

1 Answer 1

23

I've got it. The problem was with the config pair lifetime and expire_on_close.

If expire_on_close is set to true, laravel 4 will ignore lifetime. I had:

'lifetime' => 1,
'expire_on_close' => true,

and in this case, session was valid after 1 min - it would only expire after closing browser. I changed it to:

'lifetime' => 1,
'expire_on_close' => false,

and now session is expiring after 1 min. no matter if browser is closed or not - close enough to what I've wanted.

The reason why I was confused and haven't figured it out earlier was that the comments there are unclear in that matter and that in Laravel 3 it worked differently...

6
  • 1
    Is this anywhere in the documentation? Really should be. I also ran into the same problem and had no idea what was wrong. I don't agree with the logic from a security point of view, secure apps need the ability to set session cookies that also expire. Commented Sep 10, 2014 at 11:45
  • 1
    @JonoCoetzee I haven't found it in docs, only comments in config file gave me some hints - all in all I've spent a few hours on testing this behaviour and figured it out. I also agree that it should work better, always allowing to expire the cookie
    – Tom
    Commented Sep 10, 2014 at 13:21
  • also faced the same problem today, but in my case I need to have both supported, session lifetime 8 hours and in case the user closes the browser also destroyed. maybe any info on this theme? Commented Nov 4, 2014 at 13:05
  • Thanks. This works for me for laravel 5.1 also. wired problem one.
    – Amir
    Commented Jul 9, 2015 at 14:36
  • 1
    I searched my vendor/laravel folder for expire_on_close and found only one result. The expire_on_close config value is used here: github.com/laravel/framework/blob/5.6/src/Illuminate/Session/… This issue (and my own experience) suggests that Tom is right: github.com/laravel/framework/issues/9321#issuecomment-113331445 I will offer a pull request to improve the comments at github.com/laravel/laravel/blob/v5.6.33/config/session.php#L23 because the docs (laravel.com/docs/5.6/session#configuration) don't mention this.
    – Ryan
    Commented Aug 28, 2018 at 17:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.