How to expire SID?

[prslou]

I have a website that uses SID's in the URL. However, if you copy the URL with the SID in it, you can use that SID forever basically. There must be some timeout setting or something...can someone help me with this? Let's say after 20 minutes I want it to erase the session. I could do this by logging the SID and a timestamp then checking it against the current time, but I'm wondering if there's a simplier solution.

[bastien]

session times are set in the php.ini file...though using SID will recreate the session when passed through the URL see below

When a visitor accesses your site, PHP will check automatically (if session.auto_start is set to 1) or on your request (explicitly through session_start() or implicitly through session_register()) whether a specific session id has been sent with the request. If this is the case, the prior saved environment is recreated.

you may need to set the .ini file to use_cookies_only

Assess the importance of the data carried by your sessions and deploy addditional protections -- this usually comes at a price, reduced convenience for the user. For example, if you want to protect users from simple social engineering tactics, you need to enable session.use_only_cookies. In that case, cookies must be enabled unconditionally on the user side, or sessions will not work.

all quotes from the manual
see here