I have configured my application for close session on timeout if user do nothing during 10 minutes period. At config.yml I have this:
session:
First, watch out your gc_probability and gc_divisor. If both are set to one, that means that the probability that the garbage collector (GC) process is started on every session initialization is gc_probability / gc_divisor = 1/1 = 1 (100%).
You could leave it to the defaults or give it a higher number in order to reduce the chance of the GC being called.
For instance:
session:
# handler_id set to null will use default session handler from php.ini
handler_id: ~
cookie_lifetime: 600 # Ten minutes
gc_probability: 1
gc_divisor: 10000
Also, if you're using a Virtual Machine, check the date of your server, the resulting session cookie will be stamped with an expiry time of time() + cookie_lifetime where the time is taken from the server.
It could be possible that, if the server had a bad date, the cookie would expire inmediately. Imagine: server date 2015-01-31, your browser 2015-02-01. Server sends cookie that expires on 2015-01-31 at 11pm, your browser receives a cookie with an expiration date that has already passed.