When exactly does a php session expire?

Question

I've googled around about this and what I know so far is that the session is destroyed when the browser is closed and if the browser is just kept open, the session automatically expires after a fixed amount of time like 24 minutes.

But when does the counter for these 24 minutes start? When the server executes the session_start() line? This question might be a little long but please bear with me. Assume i have a php page with this code in it:

<?php
      session_start();
?>

If a user open this page and just keeps it open for about an hour, will the session still expire although the page is still open? And if i add the session_start() code at the beginning of every page of my site, does the counter get reset to zero every time the user open a new page of the site?

Basically I want to make a login system that logs a user out when he closes the site or clicks the log out button and i want to keep him logged in as long as he has the site open, without him getting logged out automatically after 24 minutes or any other fixed time.

Answer 1

The timing starts when the session is first created. After the 24 minutes, it might or might not be erased by the garbage collector as it randomly kicks in(see session.gc_* directives). What you want to do is regenerate the session every N minutes(session_regenerate_id()), so that it doesn't expire as long as the user is active.