Session storage adapter inconsistency during authentication timeout handling in Zend\Auth

Resolution

Laminas\Authentication (formerly Zend\Auth) does not provide a standard event or interface to signal identity expiration across different storage adapters. Because the AuthenticationService and StorageInterface are designed as simple data access layers, they do not track time or emit events when an identity is discarded by the underlying storage mechanism (such as PHP session garbage collection or Redis TTL).

Likely Cause of Inconsistency

The divergence occurs because the framework delegates persistence entirely to the adapter, and each adapter uses a different lifecycle trigger:

• Session Adapter: Relies on session.gc_maxlifetime. The identity remains available until PHP's probabilistic garbage collector removes the session file.
• NonPersistent Adapter: Clears the identity at the end of every request by design; it does not support timeouts because it never persists.
• Custom Adapters (Redis/DB): Use external TTLs. The identity vanishes from the store, but the application only discovers this upon the next read() call.

Recommended Implementation for Uniform Revocation

To ensure Laminas\Permissions\Acl or other authorization layers react uniformly, you must implement a wrapper for the storage adapter. This allows you to inject a consistent callback or event whenever an identity is found to be missing or expired.

1. Create a Storage Decorator: Implement Laminas\Authentication\Storage\StorageInterface. Wrap the actual adapter (e.g., Session) and intercept the read() method.
2. Implement Activity Tracking: Store a timestamp alongside the identity object. On every read(), compare the current time against the stored timestamp and your defined TTL.
3. Trigger a Custom Event: If the timestamp exceeds the TTL, call clear() on the inner adapter and trigger a custom event via Laminas\EventManager.

// Conceptual Wrapper Logic
public function read() {
    $identity = $this->innerAdapter->read();
    if ($identity && $this->isExpired($identity)) {
        $this->innerAdapter->clear();
        $this->eventManager->trigger('auth.timeout', $this, ['identity' => $identity]);
        return null;
    }
    return $identity;
}

Version Notes

There are no changes in Laminas 3.x that introduce a unified timeout event. The architecture remains decoupled, leaving session lifetime management to the PHP environment or the specific storage implementation.

Diagnostic Detail Required: Are you using a custom SessionManager configuration, or are you relying on the default php.ini session settings? This determines whether the timeout is triggered by the browser cookie or the server-side garbage collector.