SessionStore overrides PHP session cookie lifetime setting

[garnold]

Hello,

Auth0\SDK\Store\SessionStore overrides the PHP session cookie lifetime setting from php.ini if the session is not already started prior to initializing Auth0:

https://github.com/auth0/auth0-PHP/blob/master/src/Store/SessionStore.php#L41

Calling session_start() in that method is ok, but setting the cookie lifetime is an unexpected side effect given that SessionStore is automatically instantiated in the Auth0\SDK\Auth0 constructor if not specified in the $config parameter.

Thanks,
Geoff.

[joshcanhelp]

Apologies for the late response here, @garnold. I agree this is a little heavy-handed. It was done to make sure that the sessions in the PHP application match the Auth0 default sessions but both are adjustable so it makes sense to have an option for that.

Thanks for the info!

[garnold]

@joshcanhelp 👍

[github-actions]

This issue has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.