How to log user out due to inactivity

Question

Pure, server-side PHP. Every time a user submits a form, I update a \'last activity\' time in the database.

I want to make a periodic check and force logout inactiv

Answer 1

Here is my version based directly on the answer by RKh.

This version will re-set the timer IF the session hasn't timed out yet. So you can paste this whole block right underneath your session_start() and you don't have to call it separately every time a user makes a request to perform an action.

/* Control Session Timeout */
if (!isset($_SESSION['LastActivity'])) {
$_SESSION['LastActivity'] = time();
}
//Set Timeout Window in Minutes
$TimeOutMinutes = 5;
//TimeOut in Seconds
$TimeOutSeconds = $TimeOutMinutes * 60; 

if (isset($_SESSION['LastActivity'])) {
    $InactiveTime = time() - $_SESSION['LastActivity'];
        //If Inactive Time more than timeout value log the user out
        if ($InactiveTime >= $TimeOutSeconds) {
            session_destroy();
            header("Location: $baseURL");
        }
        //If Inactive Time less than timeout reset the last activity to current time
        elseif ($InactiveTime < $TimeOutSeconds) {
            $_SESSION['LastActivity'] = time();
        }
    }