How to increase the session lifetime in Symfony2?

Question

I have a login with a remember checkbox. I'm tring to set lifetime of session to 1 year if the remember checkbox is checked, but no matter what I tried, it doesn't work... Symfony profiler always say that session lifetime is 0.

That's what I tryed in my controller function:

$this->getRequest()->getSession()->set("gesaudit",array("login"=>true,"user"=>$user));

if($remember == "1"){
    $lifetime = new NativeSessionStorage();
    $lifetime->setOptions(array('cookie_lifetime' => 31557600));
}else{
    $lifetime = new NativeSessionStorage();
    $lifetime->setOptions(array('cookie_lifetime' => 0));
}

Solution

Normal session lifetime can be managed, according to the documentation, via config.yml:

framework:
    session:
        cookie_lifetime: 3600

To set the lifetime to a year: 3600*24*365 = 86400*365 = 31536000. Easy :).

This sets the session cookie lifetime to 1 hour. There are tons of other things you can configure, but that's why I included a link to the documentation.
If you insist on doing this manually, in a specific case/controller, then pass the options array to the controller. Perhaps that'll work instead of using the setOptions method: If your php.ini contains:

session.auto_start = 1

Then creating the NativeSessionStorage instance will automatically, and immediately create the session, with the default lifetime. Setting it afterwards will make little or no difference. Check your ini settings, or do:

$test = new NativeSessionStorage();
var_dump($test->isStarted())

If it dumps true, try:

$lifetime = new NativeSessionStorage(
    array(
        'cookie_lifetime' => 31536000
    )
);

Everything on sessions in Symfony2 can be found here.

If you are using Symfony2.4, there is a special section in the docs that deals with remember-me functionality, as Jakub Polák pointed out. The essence of it is that the checkbox has to be called _remember_me, that the config.yml has to define a %secret% value, and that you add (a tailored) version of this to your security.yml file:

firewalls:
    main:
        remember_me:
            key:      "%secret%"
            lifetime: 31536000
            path:     /
            domain:   ~ # Defaults to the current domain from $_SERVER

But the documentation explains this all, but you'll have to "cruise" the manual a bit. For example, if you want to specify different remember-me behaviour for specific sections, change the main in the yml snippet above, and add a pattern setting, as explained here.
You'd probably best scan the entire security section.

Comments

[Admin]

"Remember me" functionality is part of Symfony2 Security, therefore the correct documentation is: symfony.com/doc/current/cookbook/security/remember_me.html

[Elias Van Ootegem]

Didn't read the question all that carefully. You're right, OP mentions remember me checkbox, will edit

[Angel]

I'm not using the security component. I'm tring to make my own bundle with my own controllers to check in any request if there are session or not. That's why I need to change the session lifetime "on the fly" when user log in. If the user check remember me, I need to set session lifetime to 1 year, else to 0. Is possible?

[Elias Van Ootegem]

@Angel: Yes, as is explained in the security extension documentation. Using that would be the best way forward. It has functionality built in to set remember-me cookies for as long as you want/need, for specific parts of your project. It's exactly what you are looking for.

[Angel]

Thanks. I need to read more about that. I'll try to implement the functionality what you're talking about.

[Elias Van Ootegem]

@Angel: quickly checked the docs on the NativeSessionStorage class. It can't set the session.auto_start option, so if your ini settings have auto_start set to true/1, then you can't use the setOptions method to change the lifetime. Just pass the options array to the constructor instead

[Angel]

@EliasVanOotegem I tried to make something like $lifetime = new NativeSessionStorage(array('cookie_lifetime'=>31557600)); and it doesn't work.