1.10.6 Session Destruction

Every time a session is accessed or created there is a certain probability (specified by the cleanup parameter) that the session module will look through all sessions to see which ones have expired, removing session information as necessary. This means sessions don't necessarily get destroyed when they expire. Setting the cleanup parameter too high means unnecessary work is done checking expired session more than is needed. Too low and data may persist for a long time meaning that it takes a long time to cleanup the sessions once the cleanup process if finally begun.

Once a session has expired the data cannot be accessed by the session module. If a user tries to access an expired session, the session is destroyed immediately.

You can manually destroy the session using the destroy() function.

See About this document... for information on suggesting changes.