So, the task at hand was simply to increase the session timeout period, so users could stay on the form for a longer time without losing their sessions.
Seems easy enough. The CakePHP
config.php file has some settings that play directly into this:
Session.timeout is an integer representing the number of seconds in the session. Well, not exactly. It’s a multiplier value, and the actual session timeout duration is determined by multiplying
Session.timeout by the value associated with
Security.level, which itself has three possible values:
low, corresponding respectively to ×10, ×100 and ×300.
I already had
Security.level set to
Session.timeout set to
1800, so really, the sessions should have stayed alive for over six days of inactivity. And yet, sessions were timing out after about 20 minutes. What gives?
What gives is another value in the
CakePHP offers a number of ways to store session data, but the default value is
php, which means it uses the built-in session functionality in PHP. The problem is, PHP has its own session timeout setting (in the
php.ini file), and frankly my dear, PHP doesn’t give a damn what CakePHP’s session timeout setting is. And so, with
Session.save left at its default
php value, my sessions were timing out after 20 minutes (the PHP default) no matter what I changed in
So, an experiment: I decided to change
cake, which tells it to use CakePHP’s own session cache, located inside your CakePHP application under
app/tmp/sessions. (Be sure that path is fully writable by Apache!)
Success! I left a browser window open on my test site overnight, and the session was still active the next morning. But along the way in my troubleshooting, I had changed my
Session.timeout value to
14400, which when combined with the
Security.level setting of
low (that is, when multiplied by 300), had my sessions enduring for a ridiculously long 50 days! Some quick work with a calculator (although, in retrospect, I ought to have been able to divide 14400 by 50 in my head) told me to set
288 if I wanted my sessions to last for 24 hours.