Time Limited Session

[eluser]WanWizard[/eluser]
Very confusing indeed, as there is also an third party library called db_session...


You shouldn't fiddle with the internals of the session. The proper way to use the session is to use session variables:
when the controller loads, you check for a specific session variable (for example user_id'). If it exists, the user is logged in. If not, the user is not logged in. In your login form, create this session variable after you have done your validations. When the user clicks on logout, delete the variable. No need to manually handle session_id's, or create or destroy sessions.

There is a second reason why using session_id's in your application is a bad idea. For security purposes, the session library rotates session_id. This means that while the session is still valid, the session_id has changed.