# Session Timeout Ignored

**URL:** https://discourse.cakephp.org/t/session-timeout-ignored/7787
**Category:** Uncategorized
**Created:** [May 5, 2020, 7:48pm UTC](https://discourse.cakephp.org/t/session-timeout-ignored/7787 "2020-05-05T19:48:08Z")
**Posts on this page:** 8
**Page:** 1

<div class="post-metadata">

### Author: ![natedl98](https://avatars.discourse-cdn.com/v4/letter/n/898d66/32.png) [@natedl98](https://discourse.cakephp.org/u/natedl98)
#### Post date: [May 5, 2020, 7:48pm UTC](https://discourse.cakephp.org/t/session-timeout-ignored/7787/1 "2020-05-05T19:48:08Z")

</div>

Hi, I have built a number of CakePHP (v3) applications over the years and have never seemed to get the session timeout to work. It seems like it always just ignores whatever I put there and it just defaults to 1440 or whatever.

My most important application employs a custom session handler with AWS DynamoDB. CakePHP’s config.session.timeout is 90, and php ini\_get returns 5400 (90 minutes) for session.gc\_maxlifetime. So it should be 90 minutes as currently set but it’s logging out at ~24 minutes.

How do I even debug this? If anyone has an actual fix, that’d be great too, but I don’t even know where to start debugging.

Thanks!

---

<div class="post-metadata">

### Author: ![Zuluru](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/zuluru/32/1230_2.png) [@Zuluru](https://discourse.cakephp.org/u/Zuluru)
#### Post date: [May 5, 2020, 9:02pm UTC](https://discourse.cakephp.org/t/session-timeout-ignored/7787/2 "2020-05-05T21:02:20Z")

</div>

What’s the expiry time on the session cookie that gets sent to your browser?

---

<div class="post-metadata">

### Author: ![natedl98](https://avatars.discourse-cdn.com/v4/letter/n/898d66/32.png) [@natedl98](https://discourse.cakephp.org/u/natedl98)
#### Post date: [May 5, 2020, 10:08pm UTC](https://discourse.cakephp.org/t/session-timeout-ignored/7787/3 "2020-05-05T22:08:26Z")

</div>

Hmmm, looking at this in firefox, it just says

Expires:“Session”

I was unaware that this existed

---

<div class="post-metadata">

### Author: ![Zuluru](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/zuluru/32/1230_2.png) [@Zuluru](https://discourse.cakephp.org/u/Zuluru)
#### Post date: [May 5, 2020, 10:38pm UTC](https://discourse.cakephp.org/t/session-timeout-ignored/7787/4 "2020-05-05T22:38:27Z")

</div>

That’s the default for cookies, they’ll last until the browser is closed. (In multi-tab scenarios, maybe until the last tab for the site is closed. I’m not sure. I never use that type of cookie.) This shouldn’t be the source of your problem, at least.

---

<div class="post-metadata">

### Author: ![natedl98](https://avatars.discourse-cdn.com/v4/letter/n/898d66/32.png) [@natedl98](https://discourse.cakephp.org/u/natedl98)
#### Post date: [May 6, 2020, 7:34pm UTC](https://discourse.cakephp.org/t/session-timeout-ignored/7787/5 "2020-05-06T19:34:43Z")

</div>

Well that’s good I guess.

Dug a little bit further but still haven’t found the issue. I doubt it’s a cakephp bug because then it would have been discovered by now

---

<div class="post-metadata">

### Author: ![Zuluru](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/zuluru/32/1230_2.png) [@Zuluru](https://discourse.cakephp.org/u/Zuluru)
#### Post date: [May 6, 2020, 8:04pm UTC](https://discourse.cakephp.org/t/session-timeout-ignored/7787/6 "2020-05-06T20:04:24Z")

</div>

You said

> [@natedl98](#):
>
> ini\_get returns 5400 (90 minutes) for session.gc\_maxlifetime

Is that a test you’re doing in the code being run by your web server? Many setups have different `php.ini` files for command line vs web server, so if you’re getting that value from the command line, it might not mean anything at all for processes run by the server.

Is that 5400 coming from your `ini` file, or being set somewhere in your code? If the latter, any chance it’s being set _after_ the session is expired by some earlier bit of code?

Does the value 1440 appear anywhere else in your `ini` file, that might somehow have some knock-on effect?

---

<div class="post-metadata">

### Author: ![natedl98](https://avatars.discourse-cdn.com/v4/letter/n/898d66/32.png) [@natedl98](https://discourse.cakephp.org/u/natedl98)
#### Post date: [May 6, 2020, 8:58pm UTC](https://discourse.cakephp.org/t/session-timeout-ignored/7787/7 "2020-05-06T20:58:41Z")

</div>

> [@Zuluru](#):
>
> Is that 5400 coming from your `ini` file, or being set somewhere in your code? If the latter, any chance it’s being set _after_ the session is expired by some earlier bit of code?

Hmmm, I don’t think it’s being set in the code anywhere other than where I guess CakePHP sets it. But this gives me an idea of something to check. Will report back once I look into it. Thanks for the idea!

---

<div class="post-metadata">

### Author: ![dreamingmind](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/dreamingmind/32/1857_2.png) [@dreamingmind](https://discourse.cakephp.org/u/dreamingmind)
#### Post date: [April 14, 2022, 4:36pm UTC](https://discourse.cakephp.org/t/session-timeout-ignored/7787/8 "2022-04-14T16:36:27Z")

</div>

Did you resolve this? and if so, how?
