Hello,
I have had a lot of trouble with Drupal in an environment where users may open many instances of the site on the one PC. In the sites/.../settings.php file:
change ini_set('session.save_handler', 'user');
to
ini_set('session.save_handler', 'files');
This change also causes unique entries in the drupal.sessions table for each browser instance.
When it is set to user, then all browsers use the same session cookie (and drupal.sessions table has a single entry), which can lead to some unexpected results, especially if there are different users logging into the different browsers, eg: for training purposes.
As I do not want my sessions to persist I have also altered the drupal/modules/users.module in the following manner:
// Destroy the current session:
session_start(); // restore the session
$_SESSION = array(); // clear the universal var
if (isset($_COOKIE[session_name()])) {
setcookie(session_name(), '', time()-42000, '/');
} // clobber the cookie
session_destroy(); // purge the session record
module_invoke_all('user', 'logout', NULL, $user);
This code forces the session cookie to be destroyed as well as the drupal.sessions database entries, causing a unique session cookie to be created whenever a user logs out. This is possibly not necessary, but in my environment I would like to do this.