Session key not timing out when set in a plugin

Question

Here's some relevant detail from my config file:

    'rememberUsernameDuration' => false,
    'rememberedUserSessionDuration' => false,
    'userSessionDuration' => 'PT30S'

I'm expecting to see sessions timing out after 30 seconds but they don't seem to be, and if I remove that they are still valid beyond the default time.

Now, one thing I'm doing is setting a session directly in a plugin:

craft()->httpSession->add('myKey', 'myData');

And retrieving:

craft()->httpSession->get('myKey');

Am I missing something here? The config file definitely affects the Craft CMS login session as with the config above I get constant warnings to keep my session open in the CMS.

Answer 1

I think you're confusing Craft's userSessionDuration - which is the amount of time that you can stay logged into the control panel - with PHP's session (which is what craft()->httpSession is a wrapper for).

When you get logged out of the control panel, the former userSession is killed, but you still keep the same underlying PHP session ID and cookie.