Sessions not closing after timeout

Did you try changing that 60 to something like 10 minutes just to rule that out as a bug?

Here's an small Application.cfc that works using cflogin with a timeout if this is of any use to you

<cfcomponent>

<cfset This.name = "yourappname">
<cfset This.Sessionmanagement="True">
<cfset This.loginstorage="session">

<cffunction name="OnRequestStart">
<cfargument name = "request" required="true"/>
<cflogin idletimeout="5">
<cfif NOT IsDefined("cflogin")>
<cfinclude template="loginform.cfm">
<cfabort>
<cfelse>
<cfif cflogin.name IS "" OR cflogin.password IS "">
<cfoutput>
<h2>You must enter both the User Name and Password fields.
</h2>
</cfoutput>
<cfinclude template="loginform.cfm">
<cfabort>
<cfelse>
yourldap lookup
<cfif loginIsGood>
<cfloginuser name="#cflogin.name#" Password="#cflogin.password#" roles="">
<cfelse>
<cfoutput>
<H2>Your login information is not valid.<br>Please Try again</H2>
</cfoutput>
<cfinclude template="loginform.cfm">
<cfabort>
</cfif>
</cfif>
</cfif>
</cflogin>
</cffunction>
</cfcomponent>

loginform.cfm

<H2>Please Log In</H2>
<cfoutput>
<form action="#CGI.script_name#?#CGI.query_string#" method="Post">
<table>
<tr>
<td>user name:</td>
<td><input type="text" name="j_username"></td>
</tr>
<tr>
<td>password:</td>
<td><input type="password" name="j_password"></td>
</tr>
</table>
<br>
<input type="submit" value="Log In">
</form>
</cfoutput>

Yes, if the session is timed out I want the variables to be setup again because it could be a different user.

So you are running along and at some point you expect to do a submit of a .cfm page and you expect that the session variables should no longer be defined. I generally am not happy with the whole timeout thing either in general. It seemed I had to jump thru some hoops to get it working the way I expected.

I do notice you selected 60 minutes versus 1 hour. Could this be the problem that it doesn't like 60 minutes?

Are you solely relying on this to catch the timed out session?

<cfif NOT IsDefined("session.ntlogin") or (IsDefined("URL.ldap") and (URL.ldap eq 'query'))>

Sorry, yes the attached code is my Application.cfm file

I'd assume that once the timeout is reached the session id and all applicable variables would be deleted. I'm not seeing that occur.

Just want to make sure you understand what a session timing out means.

1) Is this your application.cfm?

2) What do you think is the chain of events that should result in your session ending?