Has anyone seen issues with CF sessions not expiring after the sessiontimeout has passed? We're using createObject("java","coldfusion.runtime.SessionTracker") and getSessionCollection() method to get all the sessions. We know for a fact that some of the sessions are months old. But they are still there. No requests on those sessions have been made. The sessiontimeout is set to createTimeSpan(0,0,20,0) = 20 mins. The only thing I can think of is that getSessionCollection() in fact shows expired sessions too? We're on ACF2023 latest and greatest.

Hard to say what is going on here. I don't think I have ever used this. But do keep in mind that you are using an undocumented ColdFusion "feature". Your mileage may vary.

Yes. If the sessions are stored in memory, the SessionCollection is basically a Concurrent HashMap. The entries have the expiration times in them, so they would not be valid sessions but they never get deleted. With a distributed cache, this is not an issue because the cache entries themselves handle eviction.

Thanks @jclausen, that would make sense to what we're seeing. Is there anyway to get their expiration dates or whether it's still active? We're basically wanting to go through all the sessions and see if there's any active sessions with a certain condition (e.g. is the shopping cart still active). If not, sounds like we'd either need to keep our own last modified timestamp in the session (yuk), or make some assumptions on whether it's still active.

I’ve never really used that SessionCollection directly. I would suggest dumping it to get the methods and see if you can drill down to find readable timestamps or expiration offsets.