Aprenda Session Expiration and Logout Flow | Session Management in Authentication

When you build authentication systems with PHP sessions, controlling how long a session remains valid is critical for security. Session expiration strategies help protect user accounts from unauthorized access, especially if a user leaves a session open on a public or shared device. By limiting the session's lifetime, you reduce the risk that someone else could hijack an active session and gain access to sensitive information. There are two common strategies for session expiration. The first is absolute expiration, where a session is destroyed after a fixed period, regardless of activity. The second is inactivity timeout, where the session is destroyed if the user is inactive for a set period. Inactivity timeouts are especially effective, as they allow users to remain logged in while actively using your application but log them out if they walk away or close their browser without explicitly logging out.

session_timeout.php


              123456789101112131415161718192021222324252627
            
<?php
// session_timeout.php

session_start();

// Set inactivity timeout duration (in seconds)
$timeout_duration = 600; // 10 minutes

// Check if the last activity timestamp exists
if (isset($_SESSION['LAST_ACTIVITY'])) {
    // Calculate the session lifetime
    $elapsed_time = time() - $_SESSION['LAST_ACTIVITY'];
    if ($elapsed_time > $timeout_duration) {
        // Session has expired due to inactivity
        session_unset();
        session_destroy();
        header("Location: login.php?message=Session expired");
        exit();
    }
}

// Update last activity timestamp
$_SESSION['LAST_ACTIVITY'] = time();

// ... rest of your authenticated page logic ...
echo "Welcome! Your session is active.";
?>

To implement a secure logout flow in PHP, you need to properly destroy the user's session and clear all related data. The script above demonstrates how to detect inactivity and destroy the session if the timeout is reached. For a manual logout, the process involves unsetting all session variables, destroying the session, and optionally redirecting the user to a login or home page. This ensures that all authentication data is removed from the server and the session cannot be reused by anyone else. The logout process typically follows these steps: start the session, unset all session variables, destroy the session, and redirect the user to a safe location.

logout.php


              1234567891011121314151617181920212223242526272829
            
<?php
// logout.php

session_start();

// Unset all session variables
$_SESSION = array();

// If a session cookie exists, delete it
if (ini_get("session.use_cookies")) {
    $params = session_get_cookie_params();
    setcookie(
        session_name(),
        '',
        time() - 42000,
        $params["path"],
        $params["domain"],
        $params["secure"],
        $params["httponly"]
    );
}

// Destroy the session
session_destroy();

// Redirect to login page or homepage
header("Location: login.php?message=Logged out successfully");
exit();
?>

To keep your authentication system secure, always implement session expiration and a robust logout mechanism. Use inactivity timeouts, as shown in the first script, to automatically log out users who are no longer active. Make sure your logout logic, like in the second script, unsets all session variables, destroys the session, and removes any session cookies. Redirecting users after logout prevents confusion and ensures that no sensitive data remains accessible in the browser history. By following these practices, you help protect your users from session hijacking and other security threats.

Tudo estava claro?

Obrigado pelo seu feedback!

Seção 3. Capítulo 1

Pergunte à IA

Pergunte o que quiser ou experimente uma das perguntas sugeridas para iniciar nosso bate-papo

Suggested prompts:

Can you show me an example of how to implement inactivity timeout in PHP?

What are the best practices for securely destroying a PHP session?

How do I redirect users after logout in PHP?

Deslize para mostrar o menu

session_timeout.php


              123456789101112131415161718192021222324252627
            
<?php
// session_timeout.php

session_start();

// Set inactivity timeout duration (in seconds)
$timeout_duration = 600; // 10 minutes

// Check if the last activity timestamp exists
if (isset($_SESSION['LAST_ACTIVITY'])) {
    // Calculate the session lifetime
    $elapsed_time = time() - $_SESSION['LAST_ACTIVITY'];
    if ($elapsed_time > $timeout_duration) {
        // Session has expired due to inactivity
        session_unset();
        session_destroy();
        header("Location: login.php?message=Session expired");
        exit();
    }
}

// Update last activity timestamp
$_SESSION['LAST_ACTIVITY'] = time();

// ... rest of your authenticated page logic ...
echo "Welcome! Your session is active.";
?>

logout.php


              1234567891011121314151617181920212223242526272829
            
<?php
// logout.php

session_start();

// Unset all session variables
$_SESSION = array();

// If a session cookie exists, delete it
if (ini_get("session.use_cookies")) {
    $params = session_get_cookie_params();
    setcookie(
        session_name(),
        '',
        time() - 42000,
        $params["path"],
        $params["domain"],
        $params["secure"],
        $params["httponly"]
    );
}

// Destroy the session
session_destroy();

// Redirect to login page or homepage
header("Location: login.php?message=Logged out successfully");
exit();
?>

Tudo estava claro?

Obrigado pelo seu feedback!

Seção 3. Capítulo 1