Storing PHP sessions in database

Uncategorized
1

Hello,

I’m trying to resolve a complaint from our users whereby they’re frequently being logged out of Passbolt, often in the same day.

I had already followed the article about extending sessions for the FPM pool (extending “session.gc_maxlifetime” to 1209600). This has had some effect as I can see from the designated directory for session storage there are files birthed 2 weeks ago, matching the “session.gc_maxlifetime” value correctly. However our team (including me) are finding that we’re being asked to login again, usually daily.

This issue probably isn’t specific to Passbolt. In my experience of building PHP applications this exact issue has frequently been a problem when the application uses the native file based session storage, regardless of the framework or web host. Changing the session storage to either database or Redis has always resolved this.

My question is can Passbolt use its database for PHP session storage too? I noticed it’s built on CakePHP, which has native support for this.

https://book.cakephp.org/5.x/development/sessions.html#database-sessions

The Passbolt database already has the required “sessions” table in its schema. I therefore attempted this by editing the “App” section of the configuration (in “passbolt.php”):

return [
   ...

    'App' => [
        ...

        'Session' => [
            'defaults' => 'database',
        ],
        'ini' => [
            'session.cookie_lifetime' => 1209600,
        ],
    ],

    ...
];

After logging in again the sessions table is very empty, including after a server-side bin/cake cache clear_all, meaning this configuration hasn’t worked. Is there something else I can do to have database hosted sessions?

2

Hello @AdamReece-WebBox,

your passbolt.php file should look like:

'App' => [
    ...
],

'Session' => [
   'defaults' => 'database',
   'ini' => [
      'session.cookie_lifetime' => 1209600,
   ],
],
    
...

Session is defined outside of the App key.

Let me know how this worked!

1 Like
3

Cool, thanks for that. I probably read the documentation for the wrong CakePHP version.

Moving the Session key outside of App has worked. Logged in again now (and ticked remember), I’ll come back to let you all know if this turned out to be more reliable.