Whats a safe place to handle session renewal in php

Question

I'm building a website where users can login and do typical stuff on a website using php.

When users login they are given a session timer $_SESSION['LAST_ACTIVE'] = time();

I'd like to destroy that session after 30 min of inactivity. However, every time the logged-in user jumps from page to page in their 30min session, their session time resets to 30 min.

This is all working perfectly. My question is, where is the safest place to put session renewals on a website? I am using codeigniter (it uses an MVC model) and I've placed it the Views folder in a file named header.php . Could perpetrators manipulate it in anyway and extend the session timer, even if a user was inactive to hijack their accounts?

views > header.php

if (isset($_SESSION['LAST_ACTIVE']) && (time() - $_SESSION['LAST_ACTIVE'] > 3600)) 
{
    session_destroy();
    redirect('', 'refresh');
}
elseif(isset($_SESSION['LAST_ACTIVE']) && (time() - $_SESSION['LAST_ACTIVE'] < 3600)) 
{
    // setting the session with a timer
    $_SESSION['LAST_ACTIVE'] = time();
} 

Thanks

Answer 1

您可以使用应用程序的基本控制器的__constructor方法上的代码。