My business uses D7 for the company page, and on numerous occasions when navigating between pages, the user session is terminated, and the session cookies are also deleted. We have to re-login on each occasion. It happens numerous times a day and the log does not indicate anything.

Problem similar to: https://www.drupal.org/node/641140

Comments

tesmondh created an issue.

cilefen’s picture

cilefen CreditAttribution: cilefen commented

Please add to the issue summary a description of your hosting environment. I am unclear about what you mean by session cookies being deleted—cookies themselves are stored in client browsers. Are they all being deleted? What is happening in Drupal's session table?

tesmondh’s picture

tesmondh CreditAttribution: tesmondh commented

Running CentOS 6 with a LAMP environment. After a period of time after logging in, I will navigate to another page and the session is terminated. So yes, the cookies in the client browser is be deleted. The log is as below:

user 11/19/2016 - 6:44pm Session opened for tesmondh. Tesmond H
user 11/19/2016 - 6:44pm Session closed for tesmondh. Tesmond H
user 11/19/2016 - 6:44pm Session opened for tesmondh. Tesmond H
user 11/19/2016 - 6:44pm Session closed for tesmondh. Tesmond H
user 11/19/2016 - 6:33pm Session opened for tesmondh. Tesmond H
user 11/19/2016 - 6:25pm Session opened for tesmondh. Tesmond H
user 11/19/2016 - 6:02pm Session opened for tesmondh. Tesmond H
user 11/19/2016 - 6:01pm Session closed for tesmondh. Tesmond H

At no point in time did I ever click the "logout" button.

mark_fullmer’s picture

mark_fullmer
he/him
Primary language English
Location Tucson
CreditAttribution: mark_fullmer as a volunteer and commented

What are the PHP values in your settings.php file for session.gc_maxlifetime and session.cookie_lifetime? The default settings that ship with Drupal are below. Also check the server settings (e.g., phpinfo() or /admin/reports/status/php). Low (or nonexistent) settings for this could trigger the server session expiration.

/**
 * Set session lifetime (in seconds), i.e. the time from the user's last visit
 * to the active session may be deleted by the session garbage collector. When
 * a session is deleted, authenticated users are logged out, and the contents
 * of the user's $_SESSION variable is discarded.
 */
ini_set('session.gc_maxlifetime', 200000);

/**
 * Set session cookie lifetime (in seconds), i.e. the time from the session is
 * created to the cookie expires, i.e. when the browser is expected to discard
 * the cookie. The value 0 means "until the browser is closed".
 */
ini_set('session.cookie_lifetime', 2000000);
cilefen’s picture

cilefen CreditAttribution: cilefen commented

Adding to #4, did the problem begin with at a particular point in time where there was a software or a configuration change?

parthpandya24’s picture

parthpandya24 CreditAttribution: parthpandya24 commented

Which version of Drupal you are using?
If older one then update latest D7 core.

tesmondh’s picture

tesmondh CreditAttribution: tesmondh commented

I am running the latest version of Drupal 7 (7.52). The session lifetime for both values are 200000.

We tend to notice the issue after access non-drupal pages on our site that use PHP's stream_context_create to send headers to a specific non-Drupal page to tell us whether or not the user is currently logged in, and if they are; what roles do they have. That page incorporates this code:

define('DRUPAL_ROOT', getcwd());
include_once('./includes/bootstrap.inc');
drupal_bootstrap(DRUPAL_BOOTSTRAP_FULL);
global $user;

The weird thing is it hasn't done it in the last several days, it's just sometimes. Not sure why.

amit0212’s picture

amit0212 CreditAttribution: amit0212 as a volunteer and commented

You should check weather the settings.php file in drupal have the write permission, then only the changes will affect in your code.

After that, change this in settings.php.

replace ini_set('session.cookie_lifetime', 2000000);

with ini_set('session.cookie_lifetime', 0);