docs/manual/mod/mod_session.html.en

   1 <?xml version="1.0" encoding="ISO-8859-1"?>
   2 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
   3 <html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head><!--
   4         XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
   5               This file is generated from xml source: DO NOT EDIT
   6         XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
   7       -->
   8 <title>mod_session - Apache HTTP Server</title>
   9 <link href="../style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet" />
  10 <link href="../style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size" />
  11 <link href="../style/css/manual-print.css" rel="stylesheet" media="print" type="text/css" />
  12 <link href="../images/favicon.ico" rel="shortcut icon" /></head>
  13 <body>
  14 <div id="page-header">
  15 <p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/directives.html">Directives</a> | <a href="../faq/">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a></p>
  16 <p class="apache">Apache HTTP Server Version 2.3</p>
  17 <img alt="" src="../images/feather.gif" /></div>
  18 <div class="up"><a href="./"><img title="&lt;-" alt="&lt;-" src="../images/left.gif" /></a></div>
  19 <div id="path">
  20 <a href="http://www.apache.org/">Apache</a> &gt; <a href="http://httpd.apache.org/">HTTP Server</a> &gt; <a href="http://httpd.apache.org/docs/">Documentation</a> &gt; <a href="../">Version 2.3</a> &gt; <a href="./">Modules</a></div>
  21 <div id="page-content">
  22 <div id="preamble"><h1>Apache Module mod_session</h1>
  23 <div class="toplang">
  24 <p><span>Available Languages: </span><a href="../en/mod/mod_session.html" title="English">&nbsp;en&nbsp;</a></p>
  25 </div>
  26 <table class="module"><tr><th><a href="module-dict.html#Description">Description:</a></th><td>Session support</td></tr>
  27 <tr><th><a href="module-dict.html#Status">Status:</a></th><td>Extension</td></tr>
  28 <tr><th><a href="module-dict.html#ModuleIdentifier">Module Identifier:</a></th><td>session_module</td></tr>
  29 <tr><th><a href="module-dict.html#SourceFile">Source File:</a></th><td>mod_session.c</td></tr>
  30 <tr><th><a href="module-dict.html#Compatibility">Compatibility:</a></th><td>Available in Apache 2.3 and later</td></tr></table>
  31 <h3>Summary</h3>
  32
  33     <div class="warning"><h3>Warning</h3>
  34       <p>The session modules make use of HTTP cookies, and as such can fall
  35       victim to Cross Site Scripting attacks, or expose potentially private
  36       information to clients. Please ensure that the relevant risks have
  37       been taken into account before enabling the session functionality on
  38       your server.</p>
  39     </div>
  40
  41     <p>This module provides support for a server wide per user session
  42     interface. Sessions can be used for keeping track of whether a user
  43     has been logged in, or for other per user information that should
  44     be kept available across requests.</p>
  45
  46     <p>Sessions may be stored on the server, or may be stored on the
  47     browser. Sessions may also be optionally encrypted for added security.
  48     These features are divided into several modules in addition to
  49     <code class="module"><a href="../mod/mod_session.html">mod_session</a></code>; <code class="module"><a href="../mod/mod_session_crypto.html">mod_session_crypto</a></code>,
  50     <code class="module"><a href="../mod/mod_session_cookie.html">mod_session_cookie</a></code> and <code class="module"><a href="../mod/mod_session_dbd.html">mod_session_dbd</a></code>.
  51     Depending on the server requirements, load the appropriate modules
  52     into the server (either statically at compile time or dynamically
  53     via the <code class="directive"><a href="../mod/mod_so.html#loadmodule">LoadModule</a></code> directive).</p>
  54
  55     <p>Sessions may be manipulated from other modules that depend on the
  56     session, or the session may be read from and written to using
  57     environment variables and HTTP headers, as appropriate.</p>
  58
  59 </div>
  60 <div id="quickview"><h3 class="directives">Directives</h3>
  61 <ul id="toc">
  62 <li><img alt="" src="../images/down.gif" /> <a href="#session">Session</a></li>
  63 <li><img alt="" src="../images/down.gif" /> <a href="#sessionenv">SessionEnv</a></li>
  64 <li><img alt="" src="../images/down.gif" /> <a href="#sessionexclude">SessionExclude</a></li>
  65 <li><img alt="" src="../images/down.gif" /> <a href="#sessionheader">SessionHeader</a></li>
  66 <li><img alt="" src="../images/down.gif" /> <a href="#sessioninclude">SessionInclude</a></li>
  67 <li><img alt="" src="../images/down.gif" /> <a href="#sessionmaxage">SessionMaxAge</a></li>
  68 </ul>
  69 <h3>Topics</h3>
  70 <ul id="topics">
  71 <li><img alt="" src="../images/down.gif" /> <a href="#whatisasession">What is a session?</a></li>
  72 <li><img alt="" src="../images/down.gif" /> <a href="#whocanuseasession">Who can use a session?</a></li>
  73 <li><img alt="" src="../images/down.gif" /> <a href="#serversession">Keeping sessions on the server</a></li>
  74 <li><img alt="" src="../images/down.gif" /> <a href="#browsersession">Keeping sessions on the browser</a></li>
  75 <li><img alt="" src="../images/down.gif" /> <a href="#basicexamples">Basic Examples</a></li>
  76 <li><img alt="" src="../images/down.gif" /> <a href="#sessionprivacy">Session Privacy</a></li>
  77 <li><img alt="" src="../images/down.gif" /> <a href="#cookieprivacy">Cookie Privacy</a></li>
  78 <li><img alt="" src="../images/down.gif" /> <a href="#authentication">Session Support for Authentication</a></li>
  79 </ul><h3>See also</h3>
  80 <ul class="seealso">
  81 <li><code class="module"><a href="../mod/mod_session_cookie.html">mod_session_cookie</a></code></li>
  82 <li><code class="module"><a href="../mod/mod_session_crypto.html">mod_session_crypto</a></code></li>
  83 <li><code class="module"><a href="../mod/mod_session_dbd.html">mod_session_dbd</a></code></li>
  84 </ul></div>
  85 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
  86 <div class="section">
  87 <h2><a name="whatisasession" id="whatisasession">What is a session?</a></h2>
  88       <p>At the core of the session interface is a table of key and value pairs
  89       that are made accessible across browser requests.</p>
  90
  91       <p>These pairs can be set to any valid string, as needed by the
  92       application making use of the session.</p>
  93
  94     </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
  95 <div class="section">
  96 <h2><a name="whocanuseasession" id="whocanuseasession">Who can use a session?</a></h2>
  97       <p>The session interface is primarily developed for the use by other
  98       server modules, such as <code class="module"><a href="../mod/mod_auth_form.html">mod_auth_form</a></code>, however CGI
  99       based applications can optionally be granted access to the contents
 100       of the session via the HTTP_SESSION environment variable. Sessions
 101       have the option to be modified and/or updated by inserting an HTTP
 102       response header containing the new session parameters.</p>
 103
 104     </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
 105 <div class="section">
 106 <h2><a name="serversession" id="serversession">Keeping sessions on the server</a></h2>
 107       <p>Apache can be configured to keep track of per user sessions stored
 108       on a particular server or group of servers. This functionality is
 109       similar to the sessions available in typical application servers.</p>
 110
 111       <p>If configured, sessions are tracked through the use of a session ID that
 112       is stored inside a cookie, or extracted from the parameters embedded
 113       within the URL query string, as found in a typical GET request.</p>
 114
 115       <p>As the contents of the session are stored exclusively on the server,
 116       there is an expectation of privacy of the contents of the session. This
 117       does have performance and resource implications should a large number
 118       of sessions be present, or where a large number of webservers have to
 119       share sessions with one another.</p>
 120
 121       <p>The <code class="module"><a href="../mod/mod_session_dbd.html">mod_session_dbd</a></code> module allows the storage of user
 122       sessions within a SQL database via <code class="module"><a href="../mod/mod_dbd.html">mod_dbd</a></code>.</p>
 123
 124     </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
 125 <div class="section">
 126 <h2><a name="browsersession" id="browsersession">Keeping sessions on the browser</a></h2>
 127       <p>Where keeping track of a session on a server is too resource
 128       intensive or inconvenient, the option exists to store the contents
 129       of the session within a cookie on the client browser instead.</p>
 130
 131       <p>This has the advantage that minimal resources are required on the
 132       server to keep track of sessions, and multiple servers within a server
 133       farm have no need to share session information.</p>
 134
 135       <p>The contents of the session however are exposed to the client, with a
 136       corresponding risk of a loss of privacy. The
 137       <code class="module"><a href="../mod/mod_session_crypto.html">mod_session_crypto</a></code> module can be configured to encrypt the
 138       contents of the session before writing the session to the client.</p>
 139
 140       <p>The <code class="module"><a href="../mod/mod_session_cookie.html">mod_session_cookie</a></code> allows the storage of user
 141       sessions on the browser within an HTTP cookie.</p>
 142
 143     </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
 144 <div class="section">
 145 <h2><a name="basicexamples" id="basicexamples">Basic Examples</a></h2>
 146
 147       <p>Creating a session is as simple as turning the session on, and deciding
 148       where the session will be stored. In this example, the session will be
 149       stored on the browser, in a cookie called <code>session</code>.</p>
 150
 151       <div class="example"><h3>Browser based session</h3><p><code>
 152         Session On<br />
 153         SessionCookieName session path=/<br />
 154       </code></p></div>
 155
 156       <p>The session is not useful unless it can be written to or read from. The
 157       following example shows how values can be injected into the session through
 158       the use of a predetermined HTTP response header called
 159       <code>X-Replace-Session</code>.</p>
 160
 161       <div class="example"><h3>Writing to a session</h3><p><code>
 162         Session On<br />
 163         SessionCookieName session path=/<br />
 164         SessionHeader X-Replace-Session<br />
 165       </code></p></div>
 166
 167       <p>The header should contain name value pairs expressed in the same format
 168       as a query string in a URL, as in the example below. Setting a key to the
 169       empty string has the effect of removing that key from the session.</p>
 170
 171       <div class="example"><h3>CGI to write to a session</h3><p><code>
 172         #!/bin/bash<br />
 173         echo "Content-Type: text/plain"<br />
 174         echo "X-Replace-Session: key1=foo&amp;key2=&amp;key3=bar"<br />
 175         echo<br />
 176         env<br />
 177       </code></p></div>
 178
 179       <p>If configured, the session can be read back from the HTTP_SESSION
 180       environment variable. By default, the session is kept private, so this
 181       has to be explicitly turned on with the
 182       <code class="directive"><a href="#sessionenv">SessionEnv</a></code> directive.</p>
 183
 184       <div class="example"><h3>Read from a session</h3><p><code>
 185         Session On<br />
 186         SessionEnv On<br />
 187         SessionCookieName session path=/<br />
 188         SessionHeader X-Replace-Session<br />
 189       </code></p></div>
 190
 191       <p>Once read, the CGI variable <code>HTTP_SESSION</code> should contain
 192       the value <code>key1=foo&amp;key3=bar</code>.</p>
 193
 194     </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
 195 <div class="section">
 196 <h2><a name="sessionprivacy" id="sessionprivacy">Session Privacy</a></h2>
 197
 198       <p>Using the "show cookies" feature of your browser, you would have seen
 199       a clear text representation of the session. This could potentially be a
 200       problem should the end user need to be kept unaware of the contents of
 201       the session, or where a third party could gain unauthorised access to the
 202       data within the session.</p>
 203
 204       <p>The contents of the session can be optionally encrypted before being
 205       placed on the browser using the <code class="module"><a href="../mod/mod_session_crypto.html">mod_session_crypto</a></code>
 206       module.</p>
 207
 208       <div class="example"><h3>Browser based encrypted session</h3><p><code>
 209         Session On<br />
 210         SessionCryptoPassphrase secret<br />
 211         SessionCookieName session path=/<br />
 212       </code></p></div>
 213
 214       <p>The session will be automatically decrypted on load, and encrypted on
 215       save by Apache, the underlying application using the session need have
 216       no knowledge that encryption is taking place.</p>
 217
 218       <p>Sessions stored on the server rather than on the browser can also be
 219       encrypted as needed, offering privacy where potentially sensitive
 220       information is being shared between webservers in a server farm using
 221       the <code class="module"><a href="../mod/mod_session_dbd.html">mod_session_dbd</a></code> module.</p>
 222
 223     </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
 224 <div class="section">
 225 <h2><a name="cookieprivacy" id="cookieprivacy">Cookie Privacy</a></h2>
 226
 227       <p>The HTTP cookie mechanism also offers privacy features, such as the
 228       ability to restrict cookie transport to SSL protected pages only, or
 229       to prevent browser based javascript from gaining access to the contents
 230       of the cookie.</p>
 231
 232       <div class="warning"><h3>Warning</h3>
 233       <p>Some of the HTTP cookie privacy features are either non standard, or
 234       are not implemented consistently across browsers. The session modules
 235       allow you to set cookie parameters, but it makes no guarantee that privacy
 236       will be respected by the browser. If security is a concern, use the
 237       <code class="module"><a href="../mod/mod_session_crypto.html">mod_session_crypto</a></code> to encrypt the contents of the session,
 238       or store the session on the server using the <code class="module"><a href="../mod/mod_session_dbd.html">mod_session_dbd</a></code>
 239       module.</p>
 240       </div>
 241
 242       <p>Standard cookie parameters can be specified after the name of the cookie,
 243       as in the example below.</p>
 244
 245       <div class="example"><h3>Setting cookie parameters</h3><p><code>
 246         Session On<br />
 247         SessionCryptoPassphrase secret<br />
 248         SessionCookieName session path=/private;domain=example.com;httponly;secure;<br />
 249       </code></p></div>
 250
 251       <p>In cases where the Apache server forms the frontend for backend origin servers,
 252       it is possible to have the session cookies removed from the incoming HTTP headers using
 253       the <code class="directive"><a href="../mod/mod_session_cookie.html#sessioncookieremove">SessionCookieRemove</a></code> directive.
 254       This keeps the contents of the session cookies from becoming accessible from the
 255       backend server.
 256       </p>
 257
 258     </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
 259 <div class="section">
 260 <h2><a name="authentication" id="authentication">Session Support for Authentication</a></h2>
 261
 262       <p>As is possible within many application servers, authentication modules can use
 263       a session for storing the username and password after login. The
 264       <code class="module"><a href="../mod/mod_auth_form.html">mod_auth_form</a></code> saves the user's login name and password within
 265       the session.</p>
 266
 267       <div class="example"><h3>Form based authentication</h3><p><code>
 268         Session On<br />
 269         SessionCryptoPassphrase secret<br />
 270         SessionCookieName session path=/<br />
 271         AuthFormProvider file<br />
 272         AuthUserFile conf/passwd<br />
 273         AuthType form<br />
 274         AuthName realm<br />
 275         ...<br />
 276       </code></p></div>
 277
 278       <p>See the <code class="module"><a href="../mod/mod_auth_form.html">mod_auth_form</a></code> module for documentation and complete
 279       examples.</p>
 280
 281     </div>
 282 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
 283 <div class="directive-section"><h2><a name="Session" id="Session">Session</a> <a name="session" id="session">Directive</a></h2>
 284 <table class="directive">
 285 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Enables a session for the current directory or location</td></tr>
 286 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>Session On|Off</code></td></tr>
 287 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>Session Off</code></td></tr>
 288 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host, directory, .htaccess</td></tr>
 289 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
 290 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_session</td></tr>
 291 </table>
 292     <p>The <code class="directive">Session</code> directive enables a session for the
 293     directory or location container. Further directives control where the
 294     session will be stored and how privacy is maintained.</p>
 295
 296 </div>
 297 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
 298 <div class="directive-section"><h2><a name="SessionEnv" id="SessionEnv">SessionEnv</a> <a name="sessionenv" id="sessionenv">Directive</a></h2>
 299 <table class="directive">
 300 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Control whether the contents of the session are written to the
 301 <var>HTTP_SESSION</var> environment variable</td></tr>
 302 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SessionEnv On|Off</code></td></tr>
 303 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>SessionEnv Off</code></td></tr>
 304 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host, directory, .htaccess</td></tr>
 305 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
 306 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_session</td></tr>
 307 </table>
 308     <p>If set to <var>On</var>, the <code class="directive">SessionEnv</code> directive
 309     causes the contents of the session to be written to a CGI environment
 310     variable called <var>HTTP_SESSION</var>.</p>
 311
 312     <p>The string is written in the URL query format, for example:</p>
 313
 314     <div class="example"><p><code>
 315       <code>key1=foo&amp;key3=bar</code>
 316     </code></p></div>
 317
 318
 319 </div>
 320 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
 321 <div class="directive-section"><h2><a name="SessionExclude" id="SessionExclude">SessionExclude</a> <a name="sessionexclude" id="sessionexclude">Directive</a></h2>
 322 <table class="directive">
 323 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Define URL prefixes for which a session is ignored</td></tr>
 324 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SessionExclude <var>path</var></code></td></tr>
 325 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>none</code></td></tr>
 326 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host, directory, .htaccess</td></tr>
 327 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
 328 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_session</td></tr>
 329 </table>
 330     <p>The <code class="directive">SessionExclude</code> directive allows sessions to
 331     be disabled relative to URL prefixes only. This can be used to make a
 332     website more efficient, by targeting a more precise URL space for which
 333     a session should be maintained. By default, all URLs within the directory
 334     or location are included in the session. The
 335     <code class="directive"><a href="#sessionexclude">SessionExclude</a></code> directive takes
 336     precedence over the
 337     <code class="directive"><a href="#sessioninclude">SessionInclude</a></code> directive.</p>
 338
 339     <div class="warning"><h3>Warning</h3>
 340     <p>This directive has a similar purpose to the <var>path</var> attribute
 341     in HTTP cookies, but should not be confused with this attribute. This
 342     directive does not set the <var>path</var> attribute, which must be
 343     configured separately.</p></div>
 344
 345 </div>
 346 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
 347 <div class="directive-section"><h2><a name="SessionHeader" id="SessionHeader">SessionHeader</a> <a name="sessionheader" id="sessionheader">Directive</a></h2>
 348 <table class="directive">
 349 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Import session updates from a given HTTP response header</td></tr>
 350 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SessionHeader <var>header</var></code></td></tr>
 351 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>none</code></td></tr>
 352 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host, directory, .htaccess</td></tr>
 353 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
 354 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_session</td></tr>
 355 </table>
 356     <p>The <code class="directive">SessionHeader</code> directive defines the name of an
 357     HTTP response header which, if present, will be parsed and written to the
 358     current session.</p>
 359
 360     <p>The header value is expected to be in the URL query format, for example:</p>
 361
 362     <div class="example"><p><code>
 363       <code>key1=foo&amp;key2=&amp;key3=bar</code>
 364     </code></p></div>
 365
 366     <p>Where a key is set to the empty string, that key will be removed from the
 367     session.</p>
 368
 369
 370 </div>
 371 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
 372 <div class="directive-section"><h2><a name="SessionInclude" id="SessionInclude">SessionInclude</a> <a name="sessioninclude" id="sessioninclude">Directive</a></h2>
 373 <table class="directive">
 374 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Define URL prefixes for which a session is valid</td></tr>
 375 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SessionInclude <var>path</var></code></td></tr>
 376 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>all URLs</code></td></tr>
 377 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host, directory, .htaccess</td></tr>
 378 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
 379 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_session</td></tr>
 380 </table>
 381     <p>The <code class="directive">SessionInclude</code> directive allows sessions to
 382     be made valid for specific URL prefixes only. This can be used to make a
 383     website more efficient, by targeting a more precise URL space for which
 384     a session should be maintained. By default, all URLs within the directory
 385     or location are included in the session.</p>
 386
 387     <div class="warning"><h3>Warning</h3>
 388     <p>This directive has a similar purpose to the <var>path</var> attribute
 389     in HTTP cookies, but should not be confused with this attribute. This
 390     directive does not set the <var>path</var> attribute, which must be
 391     configured separately.</p></div>
 392
 393 </div>
 394 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
 395 <div class="directive-section"><h2><a name="SessionMaxAge" id="SessionMaxAge">SessionMaxAge</a> <a name="sessionmaxage" id="sessionmaxage">Directive</a></h2>
 396 <table class="directive">
 397 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Define a maximum age in seconds for a session</td></tr>
 398 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SessionMaxAge <var>maxage</var></code></td></tr>
 399 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>SessionMaxAge 0</code></td></tr>
 400 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host, directory, .htaccess</td></tr>
 401 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
 402 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_session</td></tr>
 403 </table>
 404     <p>The <code class="directive">SessionMaxAge</code> directive defines a time limit
 405     for which a session will remain valid. When a session is saved, this time
 406     limit is reset and an existing session can be continued. If a session
 407     becomes older than this limit without a request to the server to refresh
 408     the session, the session will time out and be removed. Where a session is
 409     used to stored user login details, this has the effect of logging the user
 410     out automatically after the given time.</p>
 411
 412     <p>Setting the maxage to zero disables session expiry.</p>
 413
 414 </div>
 415 </div>
 416 <div class="bottomlang">
 417 <p><span>Available Languages: </span><a href="../en/mod/mod_session.html" title="English">&nbsp;en&nbsp;</a></p>
 418 </div><div id="footer">
 419 <p class="apache">Copyright 2009 The Apache Software Foundation.<br />Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p>
 420 <p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/directives.html">Directives</a> | <a href="../faq/">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a></p></div>
 421 </body></html>