@@ -409,7 +409,7 @@ logged in by destroying the session after a certain period of idle time. For
409409example, it is common for banking applications to log the user out after just
4104105 to 10 minutes of inactivity. Setting the cookie lifetime here is not
411411appropriate because that can be manipulated by the client, so we must do the expiry
412- on the server side. The easiest way is to implement this via garbage collection
412+ on the server side. The easiest way is to implement this via :ref: ` session garbage collection < session-garbage-collection >`
413413which runs reasonably frequently. The ``cookie_lifetime `` would be set to a
414414relatively high value, and the garbage collection ``gc_maxlifetime `` would be set
415415to destroy sessions at whatever the desired idle period is.
@@ -443,6 +443,42 @@ particular cookie by reading the ``getLifetime()`` method::
443443The expiry time of the cookie can be determined by adding the created
444444timestamp and the lifetime.
445445
446+ .. _session-garbage-collection :
447+
448+ Configuring Garbage Collection
449+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
450+
451+ When a session opens, PHP will call the ``gc `` handler randomly according to the
452+ probability set by ``session.gc_probability `` / ``session.gc_divisor ``. For
453+ example if these were set to ``5/100 `` respectively, it would mean a probability
454+ of 5%. Similarly, ``3/4 `` would mean a 3 in 4 chance of being called, i.e. 75%.
455+
456+ If the garbage collection handler is invoked, PHP will pass the value stored in
457+ the ``php.ini `` directive ``session.gc_maxlifetime ``. The meaning in this context is
458+ that any stored session that was saved more than ``gc_maxlifetime `` ago should be
459+ deleted. This allows one to expire records based on idle time.
460+
461+ However, some operating systems (e.g. Debian) do their own session handling and set
462+ the ``session.gc_probability `` variable to ``0 `` to stop PHP doing garbage
463+ collection. That's why Symfony now overwrites this value to ``1 ``.
464+
465+ If you wish to use the original value set in your ``php.ini ``, add the following
466+ configuration:
467+
468+ .. code-block :: yaml
469+
470+ # config/packages/framework.yaml
471+ framework :
472+ session :
473+ # ...
474+ gc_probability : null
475+
476+ You can configure these settings by passing ``gc_probability ``, ``gc_divisor ``
477+ and ``gc_maxlifetime `` in an array to the constructor of
478+ :class: `Symfony\\ Component\\ HttpFoundation\\ Session\\ Storage\\ NativeSessionStorage `
479+ or to the :method: `Symfony\\ Component\\ HttpFoundation\\ Session\\ Storage\\ NativeSessionStorage::setOptions `
480+ method.
481+
446482.. _session-database :
447483
448484Store Sessions in a Database
0 commit comments