How to make guest cart expire after inactivity instead of time limit?

Question

I want to extend the length of a guest's cart and have had no luck finding an answer that takes into account user activity. I've done some digging and this is how I think a cart expires for a guest user:

session_start() is called by Magento\Framework\Session\SessionManager

The session itself lasts at least as long as php's session.gc_maxlifetime setting. The session can be stored longer depending on other settings which I don't need to go into.

The session cookie lifetime, default PHPSESSID, uses the default value of 3600 seconds. This can be changed in admin, although the cookie does not seem to get reset on each page visit by default. This means the cart will expire in 1 hour no matter what.

The question I have is, how can I reset the cookie expiration so that an active user doesn't have their session deleted? Essentially doing what this answer suggests, but in Magento as a module.

Answer 1

You're correct about the PHP setting session.gc_maxlifetime and Magento setting Cookie lifetime being the parts that matter. Sessions (including guest carts and logins) last for the lesser of these after last activity.

That last part is key: You're incorrect about the cookie lifetime setting behavior. It's not the maximum total lifetime of the cookie, it's the maximum lifetime after it's last set. It is (or should be) set every time the user visits a page on your site. That means it's by default 1 hour after their last visit, not 1 hour after their first. (Actually 24 minutes; session.gc_maxlifetime defaults to 1440 seconds, or 24 minutes.)

That being said, what I describe is how it should work, and how it has worked in the past (like on Magento 1). There may be a bug in your Magento version that prevents that session refreshing from happening. There is an active bug report about exactly that, indicating it is bugged at least as recently as 2.1.6: https://github.com/magento/magento2/issues/7627

Also, admin session lifetime follows the same concepts, there's just a separate setting for admin cookie lifetime. You'll find that under Configuration > Advanced > Admin. I believe the current default is 15 minutes.

---

I recommend 1-3 days for the frontend session lifetimes, and something under 1 day for admin session lifetime. You don't want to go too high on the admin one for security reasons, and you don't want frontend cookies to last too long or else you'll have a neverending nightmare if your cookies are ever misconfigured.