diff --git a/webapp/bootstrap/constant.php b/webapp/bootstrap/constant.php
index cf033cd2..8401fb1d 100644
--- a/webapp/bootstrap/constant.php
+++ b/webapp/bootstrap/constant.php
@@ -2,6 +2,8 @@
 
 define('TEAMID_KEY', 'team_uuid:');
 
+define('LAST_SESSION_KEY', 'last_session:');
+
 define('V_ITEM_GOLD', 10001);  //金币
 define('V_ITEM_DIAMOND', 10002);  //钻石
 define('V_ITEM_EXP', 10003);  //经验
diff --git a/webapp/controller/BaseAuthedController.class.php b/webapp/controller/BaseAuthedController.class.php
index 4fe226ec..4a8a2ea2 100644
--- a/webapp/controller/BaseAuthedController.class.php
+++ b/webapp/controller/BaseAuthedController.class.php
@@ -25,13 +25,33 @@ class BaseAuthedController extends BaseController {
 
     public function _handlePre()
     {
-        $this->accountId = $_REQUEST['account_id'];
-        $this->sessionId = $_REQUEST['session_id'];
+        $this->accountId = getReqVal('account_id', '');
+        $this->sessionId = getReqVal('session_id', '');
         if (!phpcommon\isValidSessionId($this->accountId,
-                                       $this->sessionId)) {
+                                        $this->sessionId)) {
             phpcommon\sendError(500, 'invalid session_id');
            die();
         }
+        if (!(getReqVal('c', '') == 'User' && getReqVal('c', '') == 'login')) {
+            $r = $this->_getRedis($this->_getAccountId());
+            $sessionId = $r->get(LAST_SESSION_KEY . $this->_getAccountId());
+            if (empty($sessionId)) {
+                $this->updateSession(myself()->_getAccountId(),
+                                     myself()->_getSessionId());
+            } else if ($sessionId != $this->_getSessionId()) {
+                error_log('session expiration' . json_encode(
+                    $_REQUEST
+                ));
+                phpcommon\sendError(1001, 'session expiration');
+            }
+        }
+    }
+
+    protected function updateSession($accountId, $sessionId)
+    {
+        $r = $this->_getRedis($this->_getAccountId());
+        $r->set(LAST_SESSION_KEY . $this->_getAccountId());
+        $r->pexpire(LAST_SESSION_KEY . $this->_getAccountId(), 3600 * 24);
     }
 
     public function _getAccountId()
diff --git a/webapp/controller/UserController.class.php b/webapp/controller/UserController.class.php
index d005bffa..33d3d3d9 100644
--- a/webapp/controller/UserController.class.php
+++ b/webapp/controller/UserController.class.php
@@ -24,8 +24,11 @@ class UserController extends BaseAuthedController {
 
     public function login()
     {
+        $this->updateSession(myself()->_getAccountId(), myself()->_getSessionId());
+
         //$user_name = $_REQUEST['name'];
         //$avatar_url = $_REQUEST['avatar_url'];
+
         $userName = 'guest';
         $avatarUrl = '18003';