Session logout problems | CodeIgniter Forums

1 of 2

Session logout problems

Stu Green

Posted: 13 May 2009 05:42 PM

[ Ignore ]

Lab Assistant

Total Posts: 112

Joined 03-09-2009

Hiya,

Having problems with the session cookies. I’m getting logged out when just browsing around my sites when logged in. Sometimes (quite rightly) it times out after inactivity. But other times it just logs me out randomly.

This is for a CMS so it needs to allow page inactivity for 20 mins or so (in case they are writing a long page), but then it automatically updates the page every 30 seconds anyway, so there is always activity, but I want the session to stay logged in for 20 minutes before expiring.

I need the optimum, secure configuration for the session cookies - what do people recommend?

current set up is the following:

$config['sess_cookie_name']        = 'my_session';
$config['sess_expiration']        = 1800;
$config['sess_encrypt_cookie']    = TRUE;
$config['sess_use_database']    = TRUE;
$config['sess_table_name']        = 'ci_sessions';
$config['sess_match_ip']        = FALSE;
$config['sess_match_useragent']    = TRUE;
$config['sess_time_to_update']     = 600; 

Please advise.

Signature

——————————

Stu,
Huge fan of CodeIgniter and managing director of Haloweb Ltd.

Our stuff:
Free Open Source CMS - Halogy, built on CodeIgniter
Free Invoice Software - Invoice Bubble, built on CodeIgniter
Simple Project Management Software - Project Bubble, built on CodeIgniter

Profile

Dam1an

Posted: 13 May 2009 06:22 PM

[ Ignore ] [ # 1 ]

Sr. Research Associate

Total Posts: 2674

Joined 05-18-2008

Are you storing a lot of session data when you get logged out? Remember there is a 4K limit, and they encrypted, so you have a lot less then you think

Do you lose the entire userdata or just the logged_in flag?

Signature

I’m building a Project Management System for my 3rd year Uni project, Sign up to the beta
Track my progress | Post of the day: UI Designs
Get full auto complete support for CodeIgniter in Eclipse

Profile

bargainph

Posted: 13 May 2009 09:07 PM

[ Ignore ] [ # 2 ]

Lab Technician

Total Posts: 1264

Joined 04-19-2008

Dam1an - 13 May 2009 10:22 PM
Are you storing a lot of session data when you get logged out? Remember there is a 4K limit, and they encrypted, so you have a lot less then you think

Do you lose the entire userdata or just the logged_in flag?

If it is like what Dam1an says, then you could probably use database sessions.

Signature

PinoyTech - Web Development Blog

Profile

Stu Green

Posted: 13 May 2009 09:31 PM

[ Ignore ] [ # 3 ]

Lab Assistant

Total Posts: 112

Joined 03-09-2009

Hey not sure what I’m losing to be honest, I’ll have to try and find that out.

Storing is not a problem as the row is only about 1kb.

I am using DB sessions already.

Signature

——————————

Stu,
Huge fan of CodeIgniter and managing director of Haloweb Ltd.

Our stuff:
Free Open Source CMS - Halogy, built on CodeIgniter
Free Invoice Software - Invoice Bubble, built on CodeIgniter
Simple Project Management Software - Project Bubble, built on CodeIgniter

Profile

bargainph

Posted: 13 May 2009 09:41 PM

[ Ignore ] [ # 4 ]

Lab Technician

Total Posts: 1264

Joined 04-19-2008

Ha. Yeah, didn’t see that. That happens when you don’t actually read everything in the first post

Could it be a browser problem?

Signature

PinoyTech - Web Development Blog

Profile

Dam1an

Posted: 14 May 2009 03:42 AM

[ Ignore ] [ # 5 ]

Sr. Research Associate

Total Posts: 2674

Joined 05-18-2008

haloweb - 14 May 2009 01:31 AM
Hey not sure what I’m losing to be honest, I’ll have to try and find that out.

To view you’re session data, stick the attatched profiuler in your libs directory and enable the profiler


$this->output->enable_profiler(true);

This makes it so much easier to keep track of what session data you have set when
(I can’t take credit for creating this, but I can;t remember who did)

File Attachments

MY_Profiler.zip (File Size: 1KB - Downloads: 130)

Signature

I’m building a Project Management System for my 3rd year Uni project, Sign up to the beta
Track my progress | Post of the day: UI Designs
Get full auto complete support for CodeIgniter in Eclipse

Profile

bargainph

Posted: 14 May 2009 03:49 AM

[ Ignore ] [ # 6 ]

Lab Technician

Total Posts: 1264

Joined 04-19-2008

Hmm… nice on Dam1an. This extension is quite helpful.

Signature

PinoyTech - Web Development Blog

Profile

Stu Green

Posted: 14 May 2009 01:27 PM

[ Ignore ] [ # 7 ]

Lab Assistant

Total Posts: 112

Joined 03-09-2009

Hey all thanks.

Please can someone just post the optimum settings for a secure, but quite lengthy session login.

It’s for a CMS so it has to be secure but not keep logging me out every 5 minutes of inactivity. Also there are lots of AJAX calls that happen.

Thanks

Signature

——————————

Stu,
Huge fan of CodeIgniter and managing director of Haloweb Ltd.

Our stuff:
Free Open Source CMS - Halogy, built on CodeIgniter
Free Invoice Software - Invoice Bubble, built on CodeIgniter
Simple Project Management Software - Project Bubble, built on CodeIgniter

Profile

che_anj

Posted: 15 May 2009 08:21 AM

[ Ignore ] [ # 8 ]

Summer Student

Total Posts: 6

Joined 04-08-2009

hi I’m also having trouble with my logout. It does not totally destroy the session coz I did try to paste the url and it seems I can get into without entering my username and password
here’s my code

function logout()
    {
       $this->session->sess_destroy();       
        redirect('login/index');
    } 

any ideas thanks

Profile

Michael Wales

Posted: 15 May 2009 08:23 AM

[ Ignore ] [ # 9 ]

Lab Technician

Total Posts: 2280

Joined 07-30-2007

What’s your login code look like? Settings in config.php for sessions and cookies?

Signature

Follow me on twitter here.
MichaelWales.com | MichaelWales.info

Profile

che_anj

Posted: 15 May 2009 08:31 AM

[ Ignore ] [ # 10 ]

Summer Student

Total Posts: 6

Joined 04-08-2009

here’s my login

function process_login()
    {
        $username = $this->input->post('username');    
        $password = $this->input->post('password');
        
        $this->load->model('Auth', '', TRUE);
        $data['query'] = $this->Auth->CheckAuth();
        if ($data['query']->num_rows() > 0)
            {
                $row = $data['query']->row();
                $data=array(
                            'username'=> $row->username,                        
                            'logged_in'=> TRUE    );
                $data['acl']=$row->acl;
                $this->session->set_userdata($data);
                redirect('main/index');
                
                                
            }                            

        else 
        {
            $this->session->set_flashdata('message', '<div id="message">It seems your username or password is incorrect, please try again.</div>');
            redirect('login/index');
        }
    } 

config.php for session settings

$config['sess_cookie_name']        = 'ci_session';
$config['sess_expiration']        = 7200;
$config['sess_encrypt_cookie']    = FALSE;
$config['sess_use_database']    = FALSE;
$config['sess_table_name']        = 'ci_sessions';
$config['sess_match_ip']        = FALSE;
$config['sess_match_useragent']    = TRUE;
$config['sess_time_to_update']         = 300; 

Thanks in Advance

Profile

Michael Wales

Posted: 15 May 2009 09:54 AM

[ Ignore ] [ # 11 ]

Lab Technician

Total Posts: 2280

Joined 07-30-2007

Well, we’d have to see what Auth->CheckAuth() is returning.

2 ways to attack this:
1) The easiest, load up Firebug and watch the sessions tab. Login, then logout and watch for the change in session state.
2) Login, edit your process_login() method to add a print_r($data[‘query’]) statement, logout and you should go back to the process_login(). If it does, in fact, log you back in you will be able to see what was returned in $data[‘query’] and debug from there.

Signature

Follow me on twitter here.
MichaelWales.com | MichaelWales.info

Profile

Dam1an

Posted: 15 May 2009 09:59 AM

[ Ignore ] [ # 12 ]

Sr. Research Associate

Total Posts: 2674

Joined 05-18-2008

Michael Wales - 15 May 2009 01:54 PM

1) The easiest, load up Firebug and watch the sessions tab. Login, then logout and watch for the change in session state.

What? Since when did Firebug get a session tab, I installed the latest version last week and don’t have that
Also, as the sessions in CI are encrypted cookies, would it still work?

Signature

I’m building a Project Management System for my 3rd year Uni project, Sign up to the beta
Track my progress | Post of the day: UI Designs
Get full auto complete support for CodeIgniter in Eclipse

Profile

che_anj

Posted: 15 May 2009 10:00 AM

[ Ignore ] [ # 13 ]

Summer Student

Total Posts: 6

Joined 04-08-2009

Auth->CheckAuth() returns the value of username from the database record

Profile

Michael Wales

Posted: 15 May 2009 10:34 AM

[ Ignore ] [ # 14 ]

Lab Technician

Total Posts: 2280

Joined 07-30-2007

What? Since when did Firebug get a session tab, I installed the latest version last week and don’t have that
Also, as the sessions in CI are encrypted cookies, would it still work?

Sorry, I meant the Cookies tab. Encrypted cookies are an option that he has turned off (and of course, you would turn off if you needed to debug something like this). Personally, I leave encryption off until I go production - since it’s just a flick of a boolean, nothing else needs to change in your code.

Signature

Follow me on twitter here.
MichaelWales.com | MichaelWales.info

Profile

Dam1an

Posted: 15 May 2009 10:46 AM

[ Ignore ] [ # 15 ]

Sr. Research Associate

Total Posts: 2674

Joined 05-18-2008

I didn’t even realise I could turn off cookie encryption… never needed to either (yet)
I prefer to use the profiler extension I mentioned in post [URL=http://codeigniter.com/forums/viewthread/114301/#578581]#5[/URL] which shows me all my session data along with the profiler

Signature

I’m building a Project Management System for my 3rd year Uni project, Sign up to the beta
Track my progress | Post of the day: UI Designs
Get full auto complete support for CodeIgniter in Eclipse

Profile

1 of 2

‹‹ How to create RSS feed How default is the default controller ››

Username		Remember Me?
Password		forgot password?