Session key not timing out when set in a plugin Here's some relevant detail from my config file:

    'rememberUsernameDuration' =&gt; false,
    'rememberedUserSessionDuration' =&gt; false,
    'userSessionDuration' =&gt; 'PT30S'


I'm expecting to see sessions timing out after 30 seconds but they don't seem to be, and if I remove that they are still valid beyond the default time.

Now, one thing I'm doing is setting a session directly in a plugin:

craft()-&gt;httpSession-&gt;add('myKey', 'myData');


And retrieving:

craft()-&gt;httpSession-&gt;get('myKey');


Am I missing something here? The config file definitely affects the Craft CMS login session as with the config above I get constant warnings to keep my session open in the CMS.
I think you're confusing Craft's userSessionDuration - which is the amount of time that you can stay logged into the control panel - with PHP's session (which is what craft()->httpSession is a wrapper for).

When you get logged out of the control panel, the former userSession is killed, but you still keep the same underlying PHP session ID and cookie.