I've done some research into this and have not found a definitive answer.
We have a web app that is using the PHP+Memcache session handler.
I have several questions, all interrelated, but ultimately my issue is, "Why are PHP sessions apparently not expiring when we think they should be?" i.e. The end user should be logged out of the app after a set time, but is not.
Here are the dots, please help me connect them, and tell me where I am mistaken:
- My understanding is that Memcache expires keys based on the set time, in seconds (or unix timestamp for larger values).
- The expiration is lazy -- i.e. nothing is deleted in advance
- The PHP memecache session handler uses the sessions.gc_max_lifetime to set the memcache key expiration. idk, maybe it doesn't?
- Memcache should, on serving a requested key and seeing that it is expired, not serve it (and then maybe also delete it?). But at least not serve it.
- This act of not serving it should, to PHP, equate to a deleted session and the user being logged out.
Users are not being logged out.
How can I even debug this? Memcache isn't exactly transparent.
The example case that has not been working is a site with a session timeout set to two hours. An example user would last use the site at night, and then, 8 - 10 hours later, come back to the site and still be logged on.