I have configured my application for close session on timeout if user do nothing during 10 minutes period. At config.yml
I have this:
session:
First, watch out your gc_probability
and gc_divisor
. If both are set to one, that means that the probability that the garbage collector (GC) process is started on every session initialization is gc_probability / gc_divisor = 1/1 = 1
(100%).
You could leave it to the defaults or give it a higher number in order to reduce the chance of the GC being called.
For instance:
session:
# handler_id set to null will use default session handler from php.ini
handler_id: ~
cookie_lifetime: 600 # Ten minutes
gc_probability: 1
gc_divisor: 10000
Also, if you're using a Virtual Machine, check the date of your server, the resulting session cookie will be stamped with an expiry time of time() + cookie_lifetime
where the time is taken from the server.
It could be possible that, if the server had a bad date, the cookie would expire inmediately. Imagine: server date 2015-01-31
, your browser 2015-02-01
. Server sends cookie that expires on 2015-01-31
at 11pm, your browser receives a cookie with an expiration date that has already passed.
try with these parameters :
gc_probability: 0
gc_divisor : 1000