Cookie session

docker/php.ini

@@ -3,3 +3,11 @@ post_max_size = 100M
 memory_limit = 512M
 max_execution_time = 300
 extension=imagick.so
+
+; Session configuration
+session.cookie_lifetime = 86400
+session.gc_maxlifetime = 86400
+session.cookie_httponly = 1
+session.use_strict_mode = 1
+session.cookie_secure = 0
+session.cookie_samesite = "Lax"

include/language.php

@@ -6,6 +6,10 @@ ini_set('session.cookie_httponly', 1);
 ini_set('session.use_strict_mode', 1);
 ini_set('session.cookie_secure', isset($_SERVER['HTTPS']) ? 1 : 0);
 
+// Set default session cookie lifetime to 24 hours (86400 seconds)
+ini_set('session.cookie_lifetime', 86400);
+ini_set('session.gc_maxlifetime', 86400);
+
 session_start();
 
 // The $pdo object is available from init.php which included this file.

login.php

@@ -66,13 +66,13 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
                         $seconds = 14 * 24 * 60 * 60; // Default to 2 weeks
                 }
                 
-                // Set session cookie lifetime
+                // Update session cookie with extended lifetime
-                ini_set('session.cookie_lifetime', $seconds);
-                ini_set('session.gc_maxlifetime', $seconds);
-                
-                // Update session cookie with new lifetime
                 $params = session_get_cookie_params();
                 setcookie(session_name(), session_id(), time() + $seconds, $params['path'], $params['domain'], $params['secure'], $params['httponly']);
+            } else {
+                // For normal login, set cookie to expire at end of browser session
+                $params = session_get_cookie_params();
+                setcookie(session_name(), session_id(), 0, $params['path'], $params['domain'], $params['secure'], $params['httponly']);
             }
             
             header('Location: index.php');