PHP logout of 10 mins inactivity fails

Question

code part of Login.php

            else if( ($row['Password'] == md5($pass)) ){
                    $_SESSION['user'] = $row['FName'];
                    $_SESSION['last_activity'] = time();
                    header("Location: welcome.php");
            }

Whole code of welcome.php

<?php
session_start();

if( !isset($_SESSION['user']) ){ //session  verification
    header("Location: login.php");
}
else{
    echo "Welcome, ". $_SESSION['user']. "<br>";
    echo "<a href='logout.php'> Logout </a>";
}

if( $_SESSION['last_activity'] < (time() - 600) ){ //time in seconds, 10 minutes
    session_destroy();
    header("Location: login.php");
    exit;
}
else{
    $_SESSION['last_activity'] = time();
}

?>

Question: Even I refresh the page after 10 minutes, welcome.php page kept logged in. What is wrong? Thanks

Answer 1

Try this;

$last_activity = time() - $_SESSION['last_activity'];

if( $last_activity >= 600 ){ //time in seconds, 10 minutes
    session_destroy();
    header("Location: login.php");
    exit();
}