PHP Login works but then randomly gets kicked out asked to relogin

Question

I have a php login with two users. Everything seems to work fine but I am randomly getting booted and required to log back in. I My thoughts are that my session is timing out? Sometimes there are two people using the same login at the same time. Any thoughts

<?php //login code
session_start();

if(isset($_POST['user']))
{
    $password = $_POST['pass'];
    $user = $_POST['user'];
        if ( $password == "pass" && $user == "user") {
             $_SESSION['phplogin'] = true;
             header('Location: index.php');
             exit;
    } else {

    if(isset($_POST['user']))
{
    $password = $_POST['pass'];
    $user = $_POST['user'];
        if ( $password == "pass2" && $user == "user2") {
             $_SESSION['phplogin'] = true;
             header('Location: index2.php');
             exit;
 }
}                


?>

// ===

<?php // approval code

session_start();
if (!isset($_SESSION['phplogin'])
    || $_SESSION['phplogin'] !== true) {
    header('Location: login.php'); //Replace that if login.php is somewhere else
}

    <?php // index code
include('approve.php');
include('connect.php');

?> 

Answer 1

You could try the PHP functions for getting/setting the session id. You are also able to set the cookie params as you wish: session_set_cookie_params(31536000, '/', 'your.cookiedomain'); (more information: http://www.php.net/manual/en/function.session-set-cookie-params.php)

Answer 2

Firstly your code is a little buggy so ill help you get that sorted, if your doing hard coded credentials then it would be best to keep the user / pass in an array so you do not have to rewrite your code for each user.

create a file called accounts.php and paste the following snippet

<?php

return array(
     "username" => "password"
     /*.. More Below ..*/
);

?>

then your login code:

<?php
session_start();

if(!empty($_POST['user']) || !empty($_POST['pass']))
{
    $users = require('accounts.php');

    $pass = $_POST['pass'];
    $user = $_POST['user'];

    //loop the accounts.
    foreach($users as $_username => $_password)
    {
        if(strcmp($user,$_username) === 0 && strcomp($pass,$_password) === 0)
        {
            //Valid Account
            $_SESSION['phplogin'] = true;
            header('Location: index.php');
            exit;
        }
    }
?>

this should be sufficient,

the issues regarding the logout it may be due to inactivity for the expiration period, if a request has not come into the server from the client the session garbage collector will remove the session as it has expired.

you can rad more at the link below including how it works and how to change the values:

How do I expire a PHP session after 30 minutes?

if you wanted to set custom conditions for each member such as static profile data, routing information this requires you to increase the array by 1 dimension as well as a small restructure, so your accounts page would look like so:

<?php

return array(
     array(
         "username" => "the_username",
         "password" => "the_password",
         "after_login" => "home.html"
     )
     /* More Below */
);

?>

and your login code would then be slighty changed to fit accordingly.

<?php
session_start();

if(!empty($_POST['user']) || !empty($_POST['pass']))
{
    $accounts = require('accounts.php');

    $pass = $_POST['pass'];
    $user = $_POST['user'];

    //loop the accounts.
    foreach($accounts as $account)
    {
        if(strcmp($user,$account['username']) === 0 && strcomp($pass,$account['password']) === 0)
        {
            //Valid Account
            $_SESSION['phplogin'] = true;
            header('Location: ' . $account['after_login']);
            exit;
        }
    }
?>

if your not sure what i mean by dimensions here's a quick example:

  $array[0][1][10]['username']
  /*     |  |  |       |
         |  |  |       |
         1  2  3       4    > dimension
  */

this allows the values of the 3rd dimension to always be bound to 2, and to then gets bound to 1

Hope this helps.