Customer Login Time

This has been a touchy subject in the forums over the years, but it's for use with a development site that is constantly being used for testing and would like the session to be logged in much longer. How can the customer's session be extended to stay logged in for an hour or two?

(PS - I read all the reasons why not: what if they are in Starbucks, what if someone else uses their computer, etc. But not everyone uses this open source software as a traditional store that collects actual payments. Furthermore, leaving users logged in is what contributes to the success of many sites (this forum for example). Amazon, eBay, and many, many of the biggest eCommerce sites in the world keep customers logged in, at the very least for convenience of use - someone getting into the account at Starbucks is a much bigger issue than session length and the info on how to extend session length should not be kept a secret because of users in Starbucks.)

Please someone share the hidden answer to this question.

:yes:

Upgrade to 1.5.4 and the option to turn that aspect off is available in the configuration my store section. :)

Thank you for giving the needed motivation to upgrade ;-)

So no more 24 minute sessions?

Quote:

---

Originally Posted by pricediscrimination

Thank you for giving the needed motivation to upgrade ;-)

So no more 24 minute sessions?

---

Not if you don't want them. (And as pointed out, not if they are not needed to support good/required business practices)

Btw, one set of upgrade instructions to help out: http://www.zen-cart.com/entry.php?3-...d-of-upgrading

Quote:

---

Originally Posted by mc12345678

Btw, one set of upgrade instructions to help out: http://www.zen-cart.com/entry.php?3-...d-of-upgrading

---

That is very handy. Thank you.

Quote:

---

Originally Posted by mc12345678

Upgrade to 1.5.4 and the option to turn that aspect off is available in the configuration my store section. :)

---

Upgraded the site. Found "Admin Session Timeout Enforced" in Configuration > My Store, but nothing for the front end. What I was originally talking about was for the front end.

Quote:

---

Originally Posted by pricediscrimination

Upgraded the site. Found "Admin Session Timeout Enforced" in Configuration > My Store, but nothing for the front end. What I was originally talking about was for the front end.

---

My apologies, I *was* thinking you were concerned about the admin side... The same day I think it was someone else posted a similar question, a different way trying to address the factors involved with extending the time involved with activity of a customer not being captured (ie if a product form required significant time to complete.) But the overall anwer was that regarding a customer not being active, if they are logged in and have added something to their cart, then it will be there upon next login. Otherwise, inactivity is likely a departure from trying to shop at the site, and it was described that the reason for extending the session was not apparently obvious/necessary.

So, I know that you're familiar with reasons of why not, but for those that read this thread, a good thing to help out would be the why is the extra time needed? (Nevermind, answer is in the first post.)

Quote:

---

Originally Posted by mc12345678

My apologies, I *was* thinking you were concerned about the admin side... The same day I think it was someone else posted a similar question, a different way trying to address the factors involved with extending the time involved with activity of a customer not being captured (ie if a product form required significant time to complete.) But the overall anwer was that regarding a customer not being active, if they are logged in and have added something to their cart, then it will be there upon next login. Otherwise, inactivity is likely a departure from trying to shop at the site, and it was described that the reason for extending the session was not apparently obvious/necessary.

So, I know that you're familiar with reasons of why not, but for those that read this thread, a good thing to help out would be the why is the extra time needed? (Nevermind, answer is in the first post.)

---

It's nice to not be logged out of admin for this particular site, so thank you. Also it was about time to upgrade :smile:

Can you direct me to what would extend the logged in user's session, or keep them logged in until they clear cookies or log out? Similar to Amazon, eBay, and just about any big ecommerce site (which, by the way, is personally a reason I find myself going back to those sites so often. because I am always logged in.)

Quote:

---

Originally Posted by pricediscrimination

keep them logged in until they clear cookies or log out? Similar to Amazon, eBay, and just about any big ecommerce site

---

I think I'm going to have to dispute this claim. Although I rarely use Amazon I'm quite an active Ebay user, and if I leave the computer too long with no activity I need to re-log in.

I'll also dispute this in regards to almost every 'big eCommerce site' in existence, especially those that accept credit card payments, because unless they have an automatic logout after 15 minutes (?) they will be in breach of the PCI-DSS requirements.

Ebay does have an option to stay logged in for up to 24hours, but Ebay doesn't handle any Credit Card details.

It's also often beneficial for Ebay users to stay logged in for an extended period of time because it helps prevent people from losing a bid if/when they wish to 'snipe' a product. There's nothing worse than waiting til the last second to bid on an item only to find you lose valuable time by having the bid rejected because you've been logged out. Been there, done that.

Very few other sites have a need for such a time critical operation though.

Quote:

---

Originally Posted by pricediscrimination

(which, by the way, is personally a reason I find myself going back to those sites so often. because I am always logged in.)

---

Are you *sure* that you're always logged in, and not simply being automatically relogged in (by one means or another)?

I realise that you understand the reasons for why the logouts occur, and I've seen the question asked many times about how to extend it to hours, days and indefinitely. What I've never really been able to understand is *why* people actually think this is a good idea (for an eCommerce site). Surely there comes a point where it is safe to assume that if the client hasn't performed any activity on the site that they've gone away.
To be perfectly honest, I would avoid any site that accepts my CC details but *doesn't* log me out after a relatively short period of activity. I'd consider such a site to be inherently insecure. I would like to think that other Internet shoppers are as concerned about this as I am.

Anyway, enough of my 'preaching'. I know you've heard it all before and you do appear to have a legitimate reason for wanting this (its a dev site).

Quote:

---

Originally Posted by pricediscrimination

the info on how to extend session length should not be kept a secret

---

How to do this isn't really any secret. I (and several others) have posted the information how to do this many times over the years. If you search the forums I'm sure you'll have little trouble finding the relevant posts.

The 'issue' that you'll find is that there is no single 'right way' to do this and it often (always?) requires a change to the server settings, specifically the gc_maxlifetime setting, which is generally set to 1440 seconds (24 minutes) by default.

Some servers allow you to redefine this via the php.ini file, some will require it be done via the .htaccess file, and with some servers you'll need to set it via the application_top.php file.

The syntax used is slightly different for each method so 1st you'll need to determine *where* you can set this, and then you'll need to do a Google search to find out the syntax needed.

If you add this to a place not acceptable for the server, or if you use the incorrect syntax you can easily 'kill' the site and that tends to upset people <g>.

Although I can't speak for others, I tend to be of the opinion that the people that need to *ask* how to do this *probably* don't have the knowledge or skills to make the needed changes without getting themselves into trouble thus requiring them to come back here asking how to get the site functional again, and more often than not we can't be of much help because neither us, or the person with the problem has a clue as to exactly what they did wrong in the 1st place.

So there you have it. I've actually told you what you need to do, but can't give the exact details, as this is something you need to do on your own.

Cheers
RodG