Open olegkrivtsov opened 7 years ago
But, I expect it to call it automatically when session is started. Is this a bug?
I do not think so, because this behaviour is not documented and also not implemented.
It seems I found a solution: to use cookie_lifetime
and gc_maxlifetime
options instead of remember_me_seconds
. I do not understand why we need remember_me_seconds
options, because it doesn't affect anything neither in SessionManager
nor in StandardConfig
nor in SessionConfig
. Is it deprecated? I couldn't find clear explanation from documentation why we need this option.
"Remember me" is an optional function of the session manager which you must invoke manually if you wish to use it. All it does is extend the session cookie lifetime; the timing of server-side session gc is unaffected so sessions don't actually "live" longer.
the thing to note is that session data is still subject to garbage collection based on session.gc_maxlifetime regardless of the rememberMe time set on a cookie. Calling Zend_Session::rememberMe() has no effect on garbage collection for that data.
(ref: http://stackoverflow.com/a/9539452) (it's a ZF1 reference but principle is the same)
IMO it's not a useful function in it's present state. If you want to remember a user in this way and ask them to re-authenticate on a future visit you're best off implementing a separate cookie aside from the PHP session cookie for that.
This repository has been closed and moved to laminas/laminas-session; a new issue has been opened at https://github.com/laminas/laminas-session/issues/14.
Trying to figure out how to use sessions in ZF3, I've found that
SessionManager
doesn't use the configuration I pass. For example, I configure it as follows:However,
SessionManager
never useremember_me_seconds
parameter unless I manually call itsrememberMe()
method. But, I expect it to call it automatically when session is started. Is this a bug?