A look at sessions
Handling sessions in PHP can be a bit of a challenge. They like to just disappear at random, which makes it hard to set a specific time limit for user’s sessions to expire. The reason for this is that PHP stores each client session as a separate file and then occasionally picks through them and deletes the sessions that are expired. This is a common process in software called garbage collection. Every time a user starts a session on your site (basically every page request) there’s a chance that the garbage collection process with run. You can control how likely this is to happen by setting a couple of PHP options:
ini_set('session.gc_probability', 1);
ini_set('session.gc_divisor', 100);
or you can set these in a php.ini file:
session.gc_probability = 1
session.gc_divisor = 100
This works by taking the gc_probability and dividing by the gc_divisor, so in this case 1/100 is 0.01 or 1.00% chance of running garbage collection.
The other important setting for handling user sessions is session.gc_maxlifetime. This is set to the amount of seconds a session must age before it is considered expired and therefor able to be garbage collected (deleted). So you may have something like this in your php.ini file:
session.gc_probability = 1
session.gc_divisor = 100
session.gc_maxlifetime = 86400