Why is the session not expiring on browser close when session.cookie_lifetime=0?

Question

I set up a test version of a PHP coded website which uses sessions to handle user logins. On the test server, the session would expire on browser close, since copying everything to the "clean" live server, the session stays in place on browser close and the user is still logged in even the next day after full system reboot.

In php.ini

; Lifetime in seconds of cookie or, if 0, until browser is restarted.
; http://www.php.net/manual/en/session.configuration.php#ini.session.cookie-lifetime
session.cookie_lifetime = 0

Which implies that it should expire on browser restart.

I thought maybe it was being overridden somewhere, but if I print_r the session_get_cookie_params in PHP I get

Array
(
    [lifetime] => 0
    [path] => /
    [domain] => 
    [secure] => 
    [httponly] => 
)

Is there something I am missing?

Answer 1

If you are using google chrome

if you set "continue where I left off", chrome will restore your browsing data and session cookies.

even Facebook login (without "remember me") session is retained.

for more info

google chrome setting

Answer 2

Issue is here that a Firefox has a feature called "Restore last session". If someone uses saving tabs on close then it's the same. When browser restores the last session then all session cookies will be restored too :)

So your session cookie can live forever. You can read more at Firefox session cookies