Php – Session dying after using session_regenerate_id(true)

This is due to the PHP’s session COOKIE not being refreshed upon each request or when we are calling the session_start function.

The session COOKIE is being created once when we first call the session_start and then it is left as is.

The logic behind this is that by default the session.cookie_lifetime param has a value of 0, meaning "until the browser is closed."
see: PHP docs > Session configuration.

You can also read the following bug report which describes exactly this "issue". One key point to keep from the comments there, is that if session cookie is not cleared upon browser closer (or session end), when a user, same or worse another one, reopens the browser on the same page, it will have kept the session!

Having said that, you can manually update the session COOKIE when needed. In your sample code that would be in the regenerate_session_id_loggedin() function since, you want to keep session for logged-in users.

So you can add the following at the end of the function:

/**
 * Renew the time left until this session times out.
 * If we do not do this, the session will time out based on the 
 * time when it was created rather than when it was last used.
 * @see https://www.php.net/manual/en/function.session-set-cookie-params.php#100657
 */
if(isset($_COOKIE[session_name()])) {
    setcookie(
        session_name(),
        session_id(),
        time() + (60 * 30),
       '/',
        'www.snoozelings.com',
        true,
        true
    );
}

That should fix the timeout problem.

As a side note (irrelevant to the timeout), from the docs for the session_regenerate_id, you may also need to change your logic for creating a custom session ID. There is an example in the docs page above that suggest the following steps:

1. Save and close current session via session_commit()
2. Set new session ID via session_id('YOUR_CUSTOM_ID')
3. Disable use_strict_mode
4. Start session via session_start(), which will have the newly defined ID.
5. Enable use_strict_mode

like so:

// inside of your regenerate_session_id_loggedin
$newSessionId = session_create_id();

// Customize session ID for current USER.
$sessionId = $newSessionId . "_" . $userID;

// Write and close current session;
session_commit();

// Start session with new session ID
session_id($sessionId);
ini_set('session.use_strict_mode', 0);
session_start();
ini_set('session.use_strict_mode', 1);
// ... rest of your code.

Also note, that you call session_regenerate_id which renews the session ID and then you create and assign a new one.
Furthermore, the session_regenerate_id is being called for all users regardless of their logged-in status, which is something you may or may not want.

And a second note (this too is irrelevant to the timeout): You can make some refactoring to your code in order to not repeat some logic. e.g.:

<?php

ini_set('session.use_only_cookies', 1);
ini_set('session.use_strict_mode', 1);

// Init Session config vars.
$sessionCookieLifetime = 60 * 30;

$mySessionCookieParams = [
    'lifetime' => $sessionCookieLifetime, 
    'domain' => 'www.snoozelings.com',
    'path' => '/',
    'secure' => true,
    'httponly' => true
];

session_set_cookie_params($mySessionCookieParams);

session_start();

if ( ! isset($_SESSION['last_regeneration']) ) {
    regenerateSessionByUserStatus();
} else {
    if (time() - $_SESSION['last_regeneration'] >= $sessionCookieLifetime) {
        regenerateSessionByUserStatus();
    }
}

function regenerateSessionByUserStatus() {
    session_regenerate_id(true);
    
    if (isset($_SESSION["user_id"])) {
        $userID = $_SESSION["user_id"];

        $newSessionId = session_create_id();
        $sessionId = $newSessionId . "_" . $userID;
        session_id($sessionId);

        /**
         * Renew the time left until this session times out.
         * If we do not do this, the session will time out based on the 
         * time when it was created rather than when it was last used.
         * @see https://www.php.net/manual/en/function.session-set-cookie-params.php#100657
         */
        if(isset($_COOKIE[session_name()])) {
            setcookie(
                session_name(), 
                session_id(), 
                time() + $sessionCookieLifetime, 
                $mySessionCookieParams['path'], 
                $mySessionCookieParams['domain'], 
                $mySessionCookieParams['secure'], 
                $mySessionCookieParams['httponly']
            );
        }
    }

    $_SESSION['last_regeneration'] = time();
}