A really complex subject, you can use the following:
session_set_cookie_params(600);
The witch actually sets the cookie, so the cookie expires after 10 minutes when the user makes a request to the browser without sending the phpsessid cookie, so php will issue a new session. The problem is that it does not cancel the previous session, so the previous session will still be valid.
session_set_cookie_params
source share