# Cake session unexpectedly ends

**URL:** <https://discourse.cakephp.org/t/cake-session-unexpectedly-ends/1890>\
**Category:** Need Help\
**Created:** [January 19, 2017, 9:12pm UTC](https://discourse.cakephp.org/t/cake-session-unexpectedly-ends/1890 "2017-01-19T21:12:06Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![calzone](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/calzone/32/305_2.png) [@calzone](https://discourse.cakephp.org/u/calzone)\
**Post date:** [January 19, 2017, 9:12pm UTC](https://discourse.cakephp.org/t/cake-session-unexpectedly-ends/1890/1 "2017-01-19T21:12:06Z")

</div>

I have an issue that seems to occur randomly.

From time to time, the session will abruptly end, forcing the user to log in again. This has the really deleterious side effect of the user losing data entered into a form.

This is not a timeout issue. Timeout is set to 0 for infinite sessions as long as the browser hasn’t been quit. It sometimes happens immediately after login in even.

It previously only really happened on my development server, often just after saving a file and refreshing my browser to check changes. But today, users of my production sever are complaining that it’s happening to many of them, on any page, and without any pattern. Sometimes the page works, sometimes they get booted.

I suspected something might be up with the cache so I deleted all the cache files in tmp, but shortly after doing that, it happened to me too. Tonight, when the users are all off the system, I plan to restart the server and pray this fixes the issue, whatever it may be. My other suspect is that it somehow has something to do with demand from the server, which is probably about double the normal today, although my VPS’s panel shows that memory usage has not exceeded about 25% allocation in the past three days (with MySQL server usage hitting about 63%).

I know this kind of thing also used to happen with 1.x and 2.x and I just ignored it since it was fairly rare. But I’ve never seen it happen to frequently in one day to so many different users. So it’s a definite problem, and definitely somehow related to something that must have changed somewhere between yesterday and today.

I did just do a code refresh on production from the development server. However, none of the code changes had anything to do with the config files or anything. They were all just controller and view changes.

Has anyone experienced this and have an idea of what the issue is and how to fix it?

---

<div class="post-metadata">

**Author:** ![jimgwhit](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/jimgwhit/32/378_2.png) [@jimgwhit](https://discourse.cakephp.org/u/jimgwhit)\
**Post date:** [January 20, 2017, 2:21am UTC](https://discourse.cakephp.org/t/cake-session-unexpectedly-ends/1890/2 "2017-01-20T02:21:13Z")

</div>

See session config in docs says

CakePHP’s defaults session.cookie\_secure to true, when your application is on an SSL protocol. If your application serves from both SSL and non-SSL protocols, then you might have problems with sessions being lost. If you need access to the session on both SSL and non-SSL domains you will want to disable this:

Configure::write(‘Session’, [  
‘defaults’ =\> ‘php’,  
‘ini’ =\> [  
‘session.cookie\_secure’ =\> false  
]  
]);

---

<div class="post-metadata">

**Author:** ![Graziel](https://avatars.discourse-cdn.com/v4/letter/g/71c47a/32.png) [@Graziel](https://discourse.cakephp.org/u/Graziel)\
**Post date:** [January 20, 2017, 5:39am UTC](https://discourse.cakephp.org/t/cake-session-unexpectedly-ends/1890/3 "2017-01-20T05:39:09Z")

</div>

> [@calzone](#):
>
> Timeout is set to 0 for infinite sessions as long as the browser hasn’t been quit

where did you read that 0 is infinite?  
you are probably using default ‘php’ session handler and timeout translates to  
[cake session handler](https://github.com/cakephp/cakephp/blob/master/src/Network/Session.php#L199) i dont see there special setting for 0 or in [PHP: Runtime Configuration - Manual](http://php.net/manual/en/session.configuration.php#ini.session.gc-maxlifetime)

so you probably set it 0 and why it still keeps user logged even if you set it to 0? cause of how php handles garbage collection - [PHP Session Garbage Collection: The unknown performance bottleneck – Tideways](https://tideways.io/profiler/blog/php-session-garbage-collection-the-unknown-performance-bottleneck)

---

<div class="post-metadata">

**Author:** ![calzone](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/calzone/32/305_2.png) [@calzone](https://discourse.cakephp.org/u/calzone)\
**Post date:** [January 20, 2017, 5:50am UTC](https://discourse.cakephp.org/t/cake-session-unexpectedly-ends/1890/4 "2017-01-20T05:50:59Z")

</div>

Maybe it was foolish of me, but I assumed Cake’s timeout parameter to simply be a reflection of:

> **session.cookie\_lifetime integer**  
> session.cookie\_lifetime specifies the lifetime of the cookie in seconds which is sent to the browser. The value 0 means “until the browser is closed.” Defaults to 0. See also session\_get\_cookie\_params() and session\_set\_cookie\_params().

---

<div class="post-metadata">

**Author:** ![Graziel](https://avatars.discourse-cdn.com/v4/letter/g/71c47a/32.png) [@Graziel](https://discourse.cakephp.org/u/Graziel)\
**Post date:** [January 20, 2017, 6:02am UTC](https://discourse.cakephp.org/t/cake-session-unexpectedly-ends/1890/5 "2017-01-20T06:02:42Z")

</div>

[https://book.cakephp.org/3.0/en/development/sessions.html#session-configuration](https://book.cakephp.org/3.0/en/development/sessions.html#session-configuration)

> The cookie timeout is controlled by the session.cookie\_lifetime ini value

its a separate setting

---

<div class="post-metadata">

**Author:** ![calzone](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/calzone/32/305_2.png) [@calzone](https://discourse.cakephp.org/u/calzone)\
**Post date:** [January 20, 2017, 6:13am UTC](https://discourse.cakephp.org/t/cake-session-unexpectedly-ends/1890/6 "2017-01-20T06:13:42Z")

</div>

My recollection is that previous versions of cake defaulted cookie lifetime to whatever you had timeout set to.

So let’s cut to the chase: how do you create an infinite session then?

---

<div class="post-metadata">

**Author:** ![Graziel](https://avatars.discourse-cdn.com/v4/letter/g/71c47a/32.png) [@Graziel](https://discourse.cakephp.org/u/Graziel)\
**Post date:** [January 20, 2017, 6:14am UTC](https://discourse.cakephp.org/t/cake-session-unexpectedly-ends/1890/7 "2017-01-20T06:14:29Z")

</div>

you cant, but you can set it to very high number like 6 months or a year,

EDIT:  
or just change it to some other handler that just doesnt delete it

---

<div class="post-metadata">

**Author:** ![reuben.helms](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/reuben.helms/32/172_2.png) [@reuben.helms](https://discourse.cakephp.org/u/reuben.helms)\
**Post date:** [January 20, 2017, 11:42am UTC](https://discourse.cakephp.org/t/cake-session-unexpectedly-ends/1890/8 "2017-01-20T11:42:35Z")

</div>

I suspect it’s related to this [[http://stackoverflow.com/a/3555570](http://stackoverflow.com/a/3555570)].

When you let PHP handle session storage, garbage collection can be a little brutal. If the sessions are getting saved to the same area, across multiple PHP applications, then one garbage collect can result in all sessions getting cleared, whether they are ready for it or not.

I’ve usually worked around this by using the database to store session information, however, you could also use Memcached, if available.

If PHP sessions are not sharing the same area, and you still want to use PHP managed file storage of session information, consider increasing the gc\_divisor [[http://php.net/manual/en/session.configuration.php#ini.session.gc-probability](http://php.net/manual/en/session.configuration.php#ini.session.gc-probability)].