In most server-setups, we find that the SugarCRM Session only lasts about half an hour. This is something I’ve gotten complaints about — users wanting longer sessions to ease the work day. I had spent time looking through the session-management code to find an answer and just wasn’t getting anywhere. I back-burned it until I stumbled on the solution today: SugarCRM sets session length according to a PHP configuration variable.
As it often does, the SugarCRM Forums held the question and answer. In extending the 30 minutes session timeout forum user Duzoid posts the question and it is eventually correctly answered by user Sunside. The solution is to modify the PHP configuration variable session.gc_maxlifetime. Sunside suggests placing the changed configuration in an .htaccess file due to accessibility and hosting environment limitations, but having access to my core php.ini I went ahead and changed our local Sugar instance globally.
If it is allowed on your host, then you may very well change this in the .htaccess file:
php_value session.gc_maxlifetime 14400
This should set the session lifetime to 4 hours.
Please note that if session files are shared between different scripts in different directories on your server, then you need to make this setting in each of the script directories’ .htaccess file. That is because other scripts may erase your Sugar session files if they have a shorter session lifetime.
You could also create a separate directory for Sugar session files and set this with
php_value session.save_path /my/new/sugarsessiondir
in the .htaccess that you put in your Sugar root directory. You should NOT create this directory anywhere under your htdocs, but further up in the directory structure, so that these files cannot be accessed by the webserver for security reasons.
The preferred way of setting the garbage collector’s maxlifetime would be to do it serverwide in the php.ini, but this may not be possible in some shared hosting environments.