Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm using PHP sessions as the focus for a user system on a website. As an admin of the site I would like to delete specific sessions to force users to logout. Or at least delete all the sessions so everyone has to login again (e.g. a major site update). Ideally by a php command, but if it is by deleting files I can obviously do this with php file commands.

I have shared linux web hosting (nothing special, has a cPanel interface). I saw this question Are PHP session files ever deleted?

/tmp only has statistics files, and an empty pear folder.

In writing this I thought I best check phpinfo(). session.save_path is /tmp (local and master). What sort of filenames am I looking for anyway?

share|improve this question

1 Answer 1

The big question is whether you want to be able to delete sessions for nominated users - the concept of a user id is implemented via your application code or by the framework you are using - so PHP doesn't know how to differentiate between specific users. It's quite possible to have a session without having an identifiable user; session management, authentication and authorization are all seperate concerns and the functionality provided as standard within php only addresses the former.

Having said that PHP makes it very easy to implement your own session storage, so it should be trivial to write your own functions which maintain a mapping between the user id and the session id (this doesn't have to be done in the session handler - but it is the right place to do it).

If you just want to kill off all the sessions, and your using the default handler, then just delete the files in the directory specified by session.save_path in your php.ini file.

share|improve this answer
    
As I said, session.save_path=/tmp, and there is nothing in there but files for the server statistics. –  The G Nov 9 '11 at 13:41
    
Sorry - must have missed that. Using /tmp for session data files os a bit untidy. On a nearby box running 5.1.6, my sessions are named like...sess_s1iov7jkdpv3sh80tn54tbf942 (i.e. all beginning with sess_ and owned by the webserver uid). If you've got no session files in session.save_path then they've either all been garbage collected (unlikely) or your code is overriding the path or loading a different handler. –  symcbean Nov 11 '11 at 10:47

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.