title: Safe timeout value for codeigniter session class?
body: <p>I am using codeigniter's session class to handle my PHP sessions. One of the session variables automatically created on every visit to the site is session_id:</p>
  
  <blockquote>
    <p>The user's unique Session ID (this is a statistically random string with very strong entropy, hashed with MD5 for portability, and regenerated (by default) every five minutes)</p>
  </blockquote>
  
  <p>On my site I need to have functionality to track unregistered user's and I currently have this implemented by comparing the visitor's session_id with a stored id value in a VISITOR table in the database.  This works perfectly except for the fact that the session id times out every five minutes.  I would like my application to remember visitors for longer than 5 minutes (kind of like what SO does when you post a question or answer without registering).</p>
  
  <p>My question is this: can you see any security issues with simply extending the regeneration time of the session class (to something like 12 hours)?</p>
  
  <p><strong>Update:</strong> based on the answers I've seen so far, it seems like its more of a performance concern rather than a safety issue.  Its kinda weird how the codeigniter session class works because when creating a new session, it also creates a new cookie which seems to persist as long as the session.  I guess I could create another cookie with the session ID that lasts as long as I need it to.  But how much of a performance concern would it be if I were to save the sessions for something like 12 hours?  Would it slow things down unless I have millions of unique visitors within a 12 hour period (in which case I'd have bigger problems to worry about...)?</p>