Session Cleanup in Craft
Apparently PHP's garbage collection does not work when you've set a custom PHP session save path.

Lame.

If you set the overridePhpSessionLocation config setting to false, Craft will go with whatever path Apache/PHP is configured to save sessions to. If you're not on shared hosting, then it's a perfectly safe change, too.

Setting that to false on a site that is on shared hosting has its own security implications.


  curious if there is work being done on Craft to fix this issue by default.


We're discussing what we can do in Craft itself to help with this.