ExpressionEngine® Answers is a question and answer site for administrators, end users, developers and designers for ExpressionEngine® CMS. It only takes a minute to sign up.
Sign up to join this community
This is on EE 2.10.1.
Website Sessions are set to Cookie Only.
$config['sess_expiration'] = 1440;
$config['sess_expire_on_close'] = TRUE;
phpinfo() reports session.gc_maxlifetime of 1440;
User logs in, cookie is set. User closes browser and opens again and finds that the cookie has not been cleared and so they are still logged in.
How can we enforce session cookies to expire when the session ends?
According to the code, (File /system/expressionengine/libraries/Session.php, Line 1406), ifthe boolean config item ccalled expire_session_on_browser_close is true, the session lifetime is returned as 0, which indicates a session cookie.
I would set the lifetime to 0, see if that gets it. However the real issue is...
I notice the config item called does not match your config item name in the code, this is further confirmed with the docs here : https://ellislab.com/expressionengine/user-guide/general/system_configuration_overrides.html#expire-session-on-browser-close
Use this :
$config['sess_expiration'] = 0;
$config['expire_session_on_browser_close'] = TRUE;
And you should be good as gravy :D
