Still on Drupal 7? Security support for Drupal 7 ended on 5 January 2025. Please visit our Drupal 7 End of Life resources page to review all of your options.
Drupal 7's default session settings make sessions live almost indefinitely - that may present security and performance issues.
State get's round the problem by combining roles with user-activitity sensing and AJAX calls.
Sessions may still continue indefinetely for some kinds of users
- say non-logged-in visitors to your web shop.
No need to change settings in the site's settings.php file
State may effectively - if configured so on it's settings page - override the sessions settings of settings.php (since State v. 2.0).
Good bye to 'form expired'
And no visitor will ever encounter 'form expired' upon posting a form again.
State will warn the user, if the current page has hung around too long.
Set Drupal messages that survive user logout
state_set_message('Tell the user why she/he got logged out...');
Is current request a page or an AJAX request?
state_is_page_request();
State provides simple means for checking and counting requests, by type.
Safe and easy session variables
Drupal provide no means for securing against session variable collisions.