Session remains active after automatic logout due to inactivity

Hello @whygareth !

Sorry you experience such an issue. First time I hear that ??

Can you tell me, in such a case, what is showing the sessions list (in Tools > Sessions)? Can you see the sessions having this issue, or there’s no session for this user(s)?

Hi Pierre, thank you for your timely response.
This is the case and unfortunately from further testing I noticed that it occurs in my local environment as well.
I try to summarize what is happening:

• USER A has a shared account named “TEST” and shares accesses with USER B and USER C.
• I need to set the maximum limit of concurrent users to 2, so USER A, USER B and USER C cannot log in at the same time with the “TEST” account.
• User A opens a session by logging in from Mozilla with the TEST account.
• User B opens a session by logging in from Safari with the TEST account
• User C attempts to log in but is blocked by the system (this is all correct)
• User A and User B after quickly getting the information they needed from the site close the browser WITHOUT logging out
• In the meantime their session cookie expires so when they return to the page they will no longer be logged in and in Tools>Session I see that their sessions, although still on the records page, have expired
• At that point USER C should be able to log in, correct? Instead the system goes into error signaling me that there are still two active sessions.
• This does not happen instead if a manual logout is performed where the session is really closed and even in Tools > Session it no longer exists.
• The idle time also only works with the browser window open.

I know it is many things and I thank you infinitely if you could help me comprandere better how the plugin works so I can set everything correctly.

Hi @whygareth!

Thank you for the explanation. It’s more clear for me. And I think the problem is:

The idle time also only works with the browser window open.

Because it’s not true. If the plugin is working well, the sessions are killed after “idle time” has past. Even when users have gone away…

So, we will investigate the reason why it’s not working as expected. First of all, can confirm you have traffic on the site you are testing. Or, at least, a working cron?

Thank you very much, I made a new attempt by setting an idle expire time to 15 minutes.

After logging in I closed the 2 browsers (Mozilla and Safari) I see from Tools>Session the countdown under expire time.

At the expire time reported in Tools>Session , after an additional two minutes of browsing from another browser, I continue to see the wordpress error if I try to log in.

In tools>Session I continue to see the two sessions abthough under Expire Time it reports that they expired 17 minutes ago.

I’m sorry, I would like to insist: can you confirm you have traffic on the site you are testing or, at least, a working cron?
If I ask, it’s because the garbage collector is triggered by true – real – traffic.

If so, by any chance, would you have installed DecaLog? Are you able to do this and check which message is logged when Sessions runs its garbage collector?

Yes I confirm that there is traffic on the site and Decalog is active, the live console is working. I entered a custom cron to verify that it is working properly and everything is ok.

If possible also, what do you mean by “Are you able to do that and check what message is logged when Sessions runs the garbage collector?”? In the console under “Error” nothing is loaded.

I noticed at the bottom of the page this wording, could it be about the problem?
“APCu is not available on your server. To use high peformance storage mechanism you must activate apcu PHP module.”

Don’t worry, Sessions do not need APCu, so that’s not the problem.

In Decalog, after setting an event logger (on notice level) and after some hours, you will have entries from Sessions. Mesages like “No session to auto-terminate.” or “X sessions auto-terminated.”. When these messages appear, can you tel me:
– which message(s)
– frequency of these messages.

Thanks.

Ah, and if these messages doesn’t exist, there should be errors in this events log, so if you can tell me which error messages are recorded…

Hi Pierre, sorry for the late reply, unfortunately in the console I can’t register the automatic logout as I do for the manual logout and I don’t see any error… anyway I want to take advantage of the data provided by the plugin and I’m testing a solution that destroys the session by comparing the timestamp of the ‘session_idle’ with the current one. The problem I’m having though is that the session is not actually destroyed at the end of the chosen idle time but is only destroyed if idle time has reached the limit AND ALSO STANDARD EXPIRE has reached the limit… isn’t that strange?

Ps one suggestion to improve the plugin could be to reduce the standard expire of the session cookie with smaller intervals like 15min, 30min etc.

Hi @whygareth, I must admit I do not understand what you’re doing and why you have to do it… But never mind, if it’s working for you, that’s cool ??

Thanks for the suggestion, btw.