@@ -409,7 +409,7 @@ logged in by destroying the session after a certain period of idle time. For
409
409
example, it is common for banking applications to log the user out after just
410
410
5 to 10 minutes of inactivity. Setting the cookie lifetime here is not
411
411
appropriate because that can be manipulated by the client, so we must do the expiry
412
- on the server side. The easiest way is to implement this via garbage collection
412
+ on the server side. The easiest way is to implement this via :ref: ` session garbage collection < session-garbage-collection >`
413
413
which runs reasonably frequently. The ``cookie_lifetime `` would be set to a
414
414
relatively high value, and the garbage collection ``gc_maxlifetime `` would be set
415
415
to destroy sessions at whatever the desired idle period is.
@@ -443,6 +443,42 @@ particular cookie by reading the ``getLifetime()`` method::
443
443
The expiry time of the cookie can be determined by adding the created
444
444
timestamp and the lifetime.
445
445
446
+ .. _session-garbage-collection :
447
+
448
+ Configuring Garbage Collection
449
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
450
+
451
+ When a session opens, PHP will call the ``gc `` handler randomly according to the
452
+ probability set by ``session.gc_probability `` / ``session.gc_divisor ``. For
453
+ example if these were set to ``5/100 `` respectively, it would mean a probability
454
+ of 5%. Similarly, ``3/4 `` would mean a 3 in 4 chance of being called, i.e. 75%.
455
+
456
+ If the garbage collection handler is invoked, PHP will pass the value stored in
457
+ the ``php.ini `` directive ``session.gc_maxlifetime ``. The meaning in this context is
458
+ that any stored session that was saved more than ``gc_maxlifetime `` ago should be
459
+ deleted. This allows one to expire records based on idle time.
460
+
461
+ However, some operating systems (e.g. Debian) do their own session handling and set
462
+ the ``session.gc_probability `` variable to ``0 `` to stop PHP doing garbage
463
+ collection. That's why Symfony now overwrites this value to ``1 ``.
464
+
465
+ If you wish to use the original value set in your ``php.ini ``, add the following
466
+ configuration:
467
+
468
+ .. code-block :: yaml
469
+
470
+ # config/packages/framework.yaml
471
+ framework :
472
+ session :
473
+ # ...
474
+ gc_probability : null
475
+
476
+ You can configure these settings by passing ``gc_probability ``, ``gc_divisor ``
477
+ and ``gc_maxlifetime `` in an array to the constructor of
478
+ :class: `Symfony\\ Component\\ HttpFoundation\\ Session\\ Storage\\ NativeSessionStorage `
479
+ or to the :method: `Symfony\\ Component\\ HttpFoundation\\ Session\\ Storage\\ NativeSessionStorage::setOptions `
480
+ method.
481
+
446
482
.. _session-database :
447
483
448
484
Store Sessions in a Database
0 commit comments