This is on EE 2.10.1.

Website Sessions are set to Cookie Only.

$config['sess_expiration']  = 1440;
$config['sess_expire_on_close'] = TRUE;

phpinfo() reports session.gc_maxlifetime of 1440;

User logs in, cookie is set. User closes browser and opens again and finds that the cookie has not been cleared and so they are still logged in.

How can we enforce session cookies to expire when the session ends?

1 Answer 1


According to the code, (File /system/expressionengine/libraries/Session.php, Line 1406), ifthe boolean config item ccalled expire_session_on_browser_close is true, the session lifetime is returned as 0, which indicates a session cookie.

I would set the lifetime to 0, see if that gets it. However the real issue is...

I notice the config item called does not match your config item name in the code, this is further confirmed with the docs here : https://ellislab.com/expressionengine/user-guide/general/system_configuration_overrides.html#expire-session-on-browser-close

Use this :

$config['sess_expiration']  = 0;
$config['expire_session_on_browser_close'] = TRUE;

And you should be good as gravy :D


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.