Best Way to handle Session Expiration

Authentication & Security
2

Sessions are no longer managed by PHP in 2.0, so gc_maxlifetime and other PHP settings will have no effect.

Sessions are managed using JSON Web Tokens. Here is full documentation on JWT.

Here is some of the documentation we’ve worked up thus far for 2.0:

As covered in the docs above, your DreamFactory instance respects the TTL and refresh TTL you set in your .env file. In Bitnami’s beta-3, these are set by default to:

DF_JWT_TTL=60
DF_JWT_REFRESH_TTL=120

The values are minutes. You may configure as desired.

Finally, we have implemented the ability to have a “forever session” similar to Facebook, where you’re logged in on a device until you’re explicitly logged out. This is enabled in your .env file using the DF_ALLOW_FOREVER_SESSIONS setting:

DF_ALLOW_FOREVER_SESSIONS=true

If this is enabled in .env then a user who does a POST /api/v2/user/session with

{
  "email": "user@domain.com",
  "password": "password",
  "remember_me":true
}

will have a valid session indefinitely or until he DELETE /api/v2/user/session.

1 Like