How To Timeout Session In Php

by

When working with PHP applications, it’s often necessary to implement a session timeout mechanism for security purposes or just to provide a better user experience. In this blog post, we will learn how to create a simple session timeout in PHP.

What is a session timeout?

A session timeout is a feature that automatically logs out a user or ends their session after a specified period of inactivity. This helps to prevent unauthorized access to sensitive data and resources, as well as minimizing the risk of session hijacking.

Implementing session timeout in PHP

To implement a session timeout in PHP, we need to follow these steps:

  1. Start a new session or resume an existing session using session_start().
  2. Create a variable to store the session’s timeout duration.
  3. Check the time of the last user activity and compare it with the current time. If the time difference is greater than the timeout duration, destroy the session and redirect the user to the login page or an appropriate message.

Step 1: Start a new session or resume an existing session

First, we need to include the session_start() function at the beginning of our PHP script. This function will start a new session if there isn’t an existing one, or resume an existing session that was previously created.

<?php
session_start();
?>

Step 2: Create a variable to store the session’s timeout duration

Next, we need to define a variable that will hold the timeout duration. You can set the timeout duration according to your requirements. In this example, we will set it to 5 minutes (300 seconds).

<?php
$session_timeout = 300; // 5 minutes
?>

Step 3: Check the time of the last user activity and compare it with the current time

Now, we need to check if the user has been inactive for a longer time than the specified session timeout. We will use the time() function to get the current timestamp and compare it with the timestamp of the user’s last activity, which we will store in a session variable.

<?php
if (isset($_SESSION['last_activity'])) {
    $time_since_last_activity = time() - $_SESSION['last_activity'];
    if ($time_since_last_activity > $session_timeout) {
        session_unset();
        session_destroy();
        header("Location: login.php");
        exit();
    }
}

$_SESSION['last_activity'] = time();
?>

In the code above, we first check if the $_SESSION[‘last_activity’] variable is set. If it is, we calculate the time difference between the current timestamp and the timestamp of the user’s last activity. If this difference is greater than the session timeout duration, we destroy the session and redirect the user to the login page. Otherwise, we update the $_SESSION[‘last_activity’] variable with the current timestamp.

Conclusion

In this blog post, we have learned how to create a simple session timeout mechanism in PHP. By implementing this feature, you can improve the security of your web applications and provide a better user experience. Remember to adjust the timeout duration according to your specific requirements.