kitsook
commented
5 years ago Some findings:
- the cookie timeout (in seconds) is calculated by
Session.timeoutmultiplied bySecurity::inactiveMins()multipled by 60. Therefore, in current setup: 1200 300 60 = 21600000 seconds = 250 days
- the backend session data (stored in db as configured by
IPEER_SESSION_SAVE) has anexpiresfield in which the garbage collector will clear the data (effectively end the session). It is calculated by current unix time (in seconds) +Session.timeoutmultiplied bySecurity::inactiveMins(). With current setup: 1200 * 300 = 360000 seconds = 4.167 days
$this->sessionTimeis used to check if the session is still valid. The calculation is similar toexpires. So for current setup it is around 4.167 days
With CakePHP 2.3, Security.level (and hence Security::inactiveMins()) is not used anymore. Also, with CakePHP 2.x, Security.timeout is in minutes.
The current
Session.timeoutvalue is set as 1200: https://github.com/ubc/iPeer/blob/c6da8fcedd4a720e6f097c8a608b9340e798c762/app/config/core.php#L171-L175From the comment, it was intended to be 1200 seconds. However, according to the doc, the value is in minutes.
Also need to check the value of
Security.level. This value is used in Cake 1.3.x to multiply the real session timeout value.