Saving Codeigniter Sessions in a Database

Question

I am having problems storing sessions in a database using codeigniter.

When a user logs in, a session is created and stored in the database. Data is populated in the database. When the user uses the logout button, the session data is emptied, however, the session still exists in the database.

The problem is that the user does not use the logout button, but simply closes the web browser. Session data is not freed, but the user will still be logged out. (i hava install this in my configuration file). The session must be destroyed in the database, but it is not!

When the user returns to the system after clicking the "Logout" button, the session that was created when the user first logged in is again filled with data. Therefore no problem with that.

But when the user logs in after closing the browser, he creates a new session.

This problem ends with endless sessions, sessions are created every time the user closes the browser.

something else bothers me: when I log in with an account, a session is created. When I log out with this account and log in with a different account, the session will be saved in the same account as the other account. When are new entries in the session table created?

I am using codeigniter version 2.1.3.

What am I doing wrong?

//Session config: $config['sess_cookie_name'] = 'ci_session'; $config['sess_expiration'] = 7200; $config['sess_expire_on_close'] = TRUE; $config['sess_encrypt_cookie'] = FALSE; $config['sess_use_database'] = TRUE; $config['sess_table_name'] = 'ci_sessions'; $config['sess_match_ip'] = FALSE; $config['sess_match_useragent'] = TRUE; $config['sess_time_to_update'] = 300; 

Answer 1

Your sess_expire_on_close set to TRUE , so this is the expected behavior, and you usually want this in most cases. The problem is that when you close and open the browser, a new cookie is created (hence the session). From the CI Session Class Documentation (go to the bottom where it says saving sessions in db):

Note. The Session class has a built-in garbage collection that cleans up expired sessions, so you do not need to write your own procedure to do this.

So, this is not something you need to worry about the address, orphaned sessions will automatically collect garbage from the database by the session class. If you want, you can implement the code to clear it through cron, but you really don't need to.

Now, if this presents a problem for certain registered users (for example, “remember me”), but you want the session to end at closing for everyone else, you can bypass it by manually setting another cookie that far exceeds your cookie session and match an element in it in your session. This allows you to find out who the user was and restore the session if he should worry about them. There's a bit more about this in this answer to some related question.