Sessions and sign-in

tinymash uses PHP sessions for admin authentication, CSRF protection, short-lived notices, and authorized private-site browsing. Session storage and lifetime are PHP or PHP-FPM settings, not site-content settings.

Session name

Give every installation a distinct, stable session.name:

php_value[session.name] = TINYMASHEXAMPLE

Use a cookie-safe value beginning with a letter. Keep it unchanged during upgrades. A different value makes existing browsers appear signed out; sharing one value between installations on the same hostname can create cookie collisions.

tinymash falls back to tinymash when PHP supplies an empty, default, or invalid name.

Session lifetime

session.gc_maxlifetime controls how long inactive server-side session data remains eligible to survive. For an eight-hour policy:

php_admin_value[session.gc_maxlifetime] = 28800

The actual lifetime also depends on the configured PHP session handler and its cleanup policy. A filesystem cleanup job or Redis expiry can remove data earlier if it does not follow the same value.

The normal cookie is a browser-session cookie. Closing the browser can remove it even when server-side data remains. tinymash does not provide a separate Remember me duration.

Redis sessions

Installations sharing a Redis database need separate prefixes:

php_admin_value[session.save_handler] = redis
php_admin_value[session.save_path] = tcp://127.0.0.1:6379?database=0&prefix=TINYMASHEXAMPLE:

tinymash derives a prefix from the session name when the Redis configuration permits it, but an explicit per-site prefix is easier to audit.

Cookie protection

Session cookies are HTTP-only and use a SameSite policy. Enable the Secure flag for HTTPS installations. Keep the public base URL, TLS termination, proxy headers, and PHP’s HTTPS detection consistent.

Successful sign-in rotates the session identifier and CSRF token. Sign-out destroys the session and expires the cookie. Password replacement, account disablement, user deletion, or a changed authentication record invalidates affected sessions.

Failed sign-in and password reset

tinymash throttles repeated failed sign-in attempts and records lockout information for administration and optional notification. Password-reset responses remain generic whether an account exists or is currently allowed.

E-mail password resets require SMTP plus the enabled Admin or Author reset policy. Keep HTTP Basic credentials, tinymash credentials, and secret links separate; they are different authentication layers.