How do I prevent anonymous sessions?
Find out which modules set session data by dumping these variables for anonymous requests:

var_dump(\Drupal::request()-&gt;getSession()-&gt;all());
var_dump($_SESSION);


You can ignore the symfony metadata starting with _symfony or _sf2.

Then search the code base for session set() commands setting this data. You can then either change this code or remove the session data in your own code with remove().

When all session data is removed the session will be destroyed automatically at the end of the request. The metadata doesn't count.

A special case is the symfony flash bag. Data stored here is normally only kept between two requests. Ideally the first one is a redirect so the second one happens immediately. Drupal uses the flash bag for system messages. The messages are displayed and removed by the status messages block, which is enabled by default. The messages block is uncacheable and re-built on each request, because of how the caching system handles requests containing a session.