# Session Duration - Clarification **URL:** \ **Category:** Authentication & Security\ **Created:** [January 16, 2015, 10:00am UTC](https://community.dreamfactory.com/t/session-duration-clarification/759 "2015-01-16T10:00:36Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![antonyjsmith](https://yyz1.discourse-cdn.com/flex035/user_avatar/community.dreamfactory.com/antonyjsmith/32/1203_2.png) [@antonyjsmith](https://community.dreamfactory.com/u/antonyjsmith)\ **Post date:** [January 16, 2015, 10:00am UTC](https://community.dreamfactory.com/t/session-duration-clarification/759/1 "2015-01-16T10:00:36Z")
I’m just looking to clarify a couple of things regarding session duration and expiration. There appears to be a couple methodologies for adjusting this parameter: 1. Adjusting the session.gc\_lifetime in php.ini as detailed here: > [@Defining duration of session](https://community.dreamfactory.com/t/defining-duration-of-session/238): > > Hello, I’d like to define the duration of my session when I login since I’m using an Android device. However, I can find nowhere in any of the documentation where if specifies what unit of time the “duration” parameter is in. Is it in milliseconds, seconds, minutes, hours, etc? Thanks for the help. 1. Pass a duration value in the login request body as detailed here: > [@Session expiration](https://community.dreamfactory.com/t/session-expiration/111): > > It saddens me that i can not allow a user session to NEVER expire until log out… So i looked into just on log in setting my user’s session expiration time to say a year in the future. But that doesn’t seem to be possible either. is there a way to on log in override the ticket expiration? or maybe in roles asign a default of 1year to a given user type? Assuming a discrepancy I’m just trying to ascertain which value would be favoured? Does the DSP use PHP for session garbage collection or implement it’s own solution? Would setting the php.ini value to 0 and using an override in the login request be the way to go? Thanks ---
**Author:** ![benbusse](https://yyz1.discourse-cdn.com/flex035/user_avatar/community.dreamfactory.com/benbusse/32/4_2.png) [@benbusse](https://community.dreamfactory.com/u/benbusse)\ **Post date:** [January 16, 2015, 4:21pm UTC](https://community.dreamfactory.com/t/session-duration-clarification/759/2 "2015-01-16T16:21:46Z")
Hey Antony, I’m not sure. Lee should be able to answer shortly. ---
**Author:** ![leehicks](https://yyz1.discourse-cdn.com/flex035/user_avatar/community.dreamfactory.com/leehicks/32/55_2.png) [@leehicks](https://community.dreamfactory.com/u/leehicks)\ **Post date:** [January 16, 2015, 6:33pm UTC](https://community.dreamfactory.com/t/session-duration-clarification/759/3 "2015-01-16T18:33:52Z")
@antonyjsmith Yes, the DSP uses standard PHP session garbage collection currently. The [gc\_maxlifetime](http://php.net/manual/en/session.configuration.php#ini.session.gc-maxlifetime) settings in the php.ini do control the “duration” or max lifetime of the session and can be modified on you own DSP installs. Garbage collection of the sessions is dependent on the probabilty settings as well ([Note](http://php.net/manual/en/session.configuration.php#115842) that Debian-based, i.e. Ubuntu, installs typically disable PHP garbage collection and opt for a cron job to clean up stale session files.), so actually when the sessions are cleared may not be exactly (more likely greater than) the value set in gc\_maxlifetime. This value is an integer, so the potential ([may](https://bugs.php.net/bug.php?id=45871) allow larger, though we haven’t tested anything larger) max is 65535, or about 18 hrs. You could set session.gc\_probability = 0 to totally disable session cleanup, then set a cron job (edit /etc/cron.d/php5 on Ubuntu) to clear them at the desired time. The [“session expiration”](https://community.dreamfactory.com/t/session-expiration/111) about using the duration field in login requests, explains a browser behavior that we inherited from the Yii framework. Essentially, the duration field \> 0 will cause an additional cookie to be set holding some session info that is later used to “automatically log back in” after a session has expired. It works great if your app is running in the browser with cookie support, otherwise the client has to track these additional cookies (what the forum response was intending to show). I have had limited success using this from the client. We are currently reworking session management in 2.0 and plan on providing more options for these scenarios. ---
**Author:** ![antonyjsmith](https://yyz1.discourse-cdn.com/flex035/user_avatar/community.dreamfactory.com/antonyjsmith/32/1203_2.png) [@antonyjsmith](https://community.dreamfactory.com/u/antonyjsmith)\ **Post date:** [January 19, 2015, 7:35pm UTC](https://community.dreamfactory.com/t/session-duration-clarification/759/4 "2015-01-19T19:35:00Z")
Thanks Lee, that’s very useful feedback.