How To Expire A PHP Session After 30 Minutes?

Method 1: Using session variables

Setting up a last activity timestamp: To track user activity, store a timestamp in the session when the user log in or perform an action. Update this timestamp with each user interaction.

Checking and comparing timestamps: On each page load, compare the current time with the stored timestamp. If the difference is more than 30 minutes, end the session.

Destroying the session after 30 minutes of inactivity: If the time difference is more than 30 minutes, use PHP's session_unset() and session_destroy() functions to remove all session data and end the session.

Here's a code example:

session_start();

// Check if last activity was set
if (isset($_SESSION['last_activity']) && (time() - $_SESSION['last_activity'] > 1800)) {
    // 1800 seconds = 30 minutes
    session_unset();
    session_destroy();
    header("Location: login.php");
    exit();
}

// Update last activity time stamp
$_SESSION['last_activity'] = time();

Method 2: Configuring PHP settings

Adjusting session.gc_maxlifetime: You can set the session.gc_maxlifetime value in your php.ini file or using ini_set() in your PHP code. This setting determines how long a session can be inactive before it's removed by the garbage collector.

ini_set('session.gc_maxlifetime', 1800);

Setting session.cookie_lifetime: This setting controls how long the session cookie remains valid in the user's browser. Set it to 1800 seconds (30 minutes) to match your desired timeout.

ini_set('session.cookie_lifetime', 1800);

Limitations of this approach: While adjusting PHP settings can help manage session timeouts, it has some drawbacks:

1. The garbage collector runs based on probability, so sessions might not be cleared exactly after 30 minutes.
2. These settings affect all sessions on the server, which may not be ideal if different parts of your application need different timeout periods.
3. The session.cookie_lifetime setting only affects the cookie, not the server-side session data.

For more control over session timeouts, Method 1 (using session variables) is often the better choice.