AJAX and CI Session (v1.7) w/DB

[eluser]waspfactoryuk[/eluser]
[quote author="Padraig Kennedy" date="1233255789"]

It’s not really a CI bug, more like an additional security feature that just isn’t compatible with the multiple AJAX requests. If you’re not using AJAX then race hazards are not really an issue.

I would argue that the unexpected loss of session user data during certain requests is a bug. It may not be a critical one and it may not effect everyone using CI, but it is a bug.
[/quote]

The thing is, it's not unexpected - it's even documented and operating exactly as per spec. Therefore it's a feature and not a bug. Unfortunately for us, the feature just isn't suitable for the situation we're creating by using AJAX where requests can hit almost simultaneously. Regardless of whether the server is running CI or not, updating the session with a new ID will mess up things for AJAX. The approach just isn't suitable where AJAX is concerned.

[quote author="Padraig Kennedy" date="1233255789"]For some web applications, however, having sessions expire after an hour can be very irritating since it's an hour after logging in rather than an hour since last activity. Our users would on occasion spend 5 minutes filling out a form (while on the phone to a client of their own, who won't want to repeat the information!), only to lose it when they get kicked back to the log in screen because their session timed out.
[/quote]

You can always set a long expiry time in the config and then set 'sess_time_to_update' slightly bigger if you want to avoid getting kicked off but then you're relying on the user to log off to destroy the session.

However, looking at the Session.php file, it seems like the session expiry is based on last activity not creation time (although the sess_time_to_update will be based on creation time of course otherwise it wouldn't get updated as long as requests arrive).

Line 171...

Code:

// Is the session current?
if (($session['last_activity'] + $this->sess_expiration) < $this->now)
{
    $this->sess_destroy();
    return FALSE;
}

I'm not sure why it's not working for you. Just set sess_time_to_update to something like 2 years and job done.