Settings session.cookie_lifetime=0 (0 by default) should be enough in php.ini
If you don’t have access to php.ini, you need to use ini_set().
Be sure to call ini_set() before starting a session.
If you’ve done that, be sure to clear your browser history and cookies, close the browser and try again.
If that doesn’t work, check your history settings to see if authenticated sessions should be remembered after closing the browser.
With closing the browser, I mean all browser windows, not just the one window.
Sessions can still exist after 24h, even with session.gc_maxlifetime is set to 1440.
The session garbage collection depends on session.gc_maxlifetime, session.gc_probability, session.gc_divisor and session.save_path.
Let’s assume session.gc_probability=5 and session.gc_divisor=200.
In this case PHP generates a random number between 0 and 200, and generates 5 other random numbers to compare to the first generated number.
If one of those 5 random numbers is equal to the first generated number, the garbage collector will run.
The garbage collector then searches for all sessions that have not been accessed in the last 1440 seconds and removes them from the directory set in session.save_path (or the path used by your session save handler).
When all session files are stored in the same directory, and using different gc_maxlifetimes, you’ll see that sessions that should last 1440 seconds will regularly be removed after 100 seconds.
So use another save_path when using a custom value for gc_maxlifetime.