Sessiontoken - Are they supposed to keep growing?

[Moxamint]

Hi,

In my database, the number of sessiontokens keeps growing (four times the size of the rest of the data) and don't seem to expire/disappear. How do I keep them to a minimum/reasonable size? I'm on v1.0.8.20.

Thanks, Eddy

[heatherbell]

In my database, the number of sessiontokens keeps growing and don't seem to expire/disappear. How do I keep them to a minimum/reasonable size? I'm on v1.0.8.20.

Hoping that it helps, after researching your question, the best explanation I have found is on this thread link here:
https://www.oscommerce.com/forums/topic ... ions-table

If I understand correctly, it seems to be dependent on server PHP settings, e.g. we have no issues with old sessions being cleared automagically on any of our sites (running various versions from 1.0.5.0 to 1.0.8.20).
Guessing that is done in core here:
https://github.com/CE-PhoenixCart/Phoen ... hp#L23-L25

If you go down the route of a SQL query, when dealing with timestamps, a timestamp converter is useful, e.g. https://unixtime.org/

[ecartz]

If you go down the route of a SQL query, when dealing with timestamps, a timestamp converter is useful, e.g. https://unixtime.org/

It might be easier to just do what gc does:

Code: Select all

$GLOBALS['db']->query("DELETE FROM sessions WHERE expiry < '" . (int)strtotime('-1 week') . "'");

Add that (possibly via hook) to something in admin that you visit regularly but not frequently.

If you do it in phpMyAdmin, you can use UNIX_TIMESTAMP, e.g.

Code: Select all

DELETE FROM sessions WHERE expiry < UNIX_TIMESTAMP(NOW() - INTERVAL 1 WEEK)

But the easiest solution is to change session.gc_probability and session.gc_divisor to something like 1 and 100, e.g. in includes/configure.php

Code: Select all

ini_set('session.gc_probability', 1);
ini_set('session.gc_divisor', 100);
init_set('session.gc_max_lifetime', 604800);

Make the first number larger to make it happen more frequently. Make the second number larger to make it happen less frequently. Or vice versa for smaller. The first number should be smaller than the second number. The third number is the number of seconds since the session was last used to keep it. In this example, it will run 1/100 times and clear everything older than a week (seven days times 86,400 seconds in a day). I would not set the third number smaller than 1800 (half an hour) and would prefer at least 57,600 (sixteen hours). A week will make your sessions table a lot smaller and won't impact the typical user at all.

Most likely your php.ini file has either session.gc_probability or session.gc_max_lifetime set to 0, disabling the check.

https://www.php.net/manual/en/session.c ... robability