ini_set session.gc_maxlifetime not setting TTL of session key correctly

[nordicblue]

Expected behaviour

When setting session.gc_maxlifetime, via ini_set("session.gc_maxlifetime", 86400);, have the TTL on the Redis key match the expiration time configured with the ini_set command.

Actual behaviour

The session.gc_maxlifetime value is not used from the set command, but is instead used from the value configured in php.ini.

I'm seeing this behaviour on

• OS: Ubuntu 22.04
• Redis: 6.0.16
• PHP: 8.1.25
• phpredis: 6.0.1

Steps to reproduce, backtrace or example script

I am using phpredis for session management. I am running into an issue with the TTL on the session records. When I log into my application, the code sets the session expiration by the following:

ini_set("session.gc_maxlifetime", $timeout); //value is dynamic, based on user
ini_set("session.cookie_lifetime", $timeout);
session_start();

When I check the session key, in redis, the TTL is set to the session.gc_maxlifetime value configured in the php.ini file, instead of the ini_set value. However, if I query the session value for gc_maxlifetime, the expiration value provided is the correct one set through the ini_set command.

Issue here is, of course, that the session key will delete because it has a TTL of the value configured in the php.ini and that value can be smaller than the value configured through the ini_set command.

How do I get the TTL on the key to match the TTL that is set during login please?

Thanks for your help!

I've checked

• [X ] There is no similar issue from other users