orphan sessions are a pain.
If a session was not closed cleanly (application crashed, or possibly if you hit back button on browser or simply closed the browser), then sometimes the server thinks the session is still active. My understanding is that is just the way that the web servers and browsers work and not really anything appeon can do. Chrome is pretty bad in that it won't notify the server that a tab is closing or the browser shut down.... Also, we sometimes have impatient users and they force a browser crash instead of waiting for a process to finish, and that usually leaves the session open too.
There are settings in AEM that will time it out (see picture armeen sent). That can be a little bit tricky in coming up with a good timeout time. Its better than nothing, but too short a time is usually not good either. i have session timeout set to 1800 seconds which has worked well for us. That helps, but on its own, it still leaves a lot of open sessions.
One of the things i do is register the session id, username and ip adress in a table when the person logs in. I then check to see if the same user id and IP address has another session id that has not been closed out. There is an appeon/powerserver function call you can make that returns all the active sessions. If the session is still active, i notify the user and asks them if they want the other session to be killed. Usually they do want that old session killed. This helps out a lot.
If you don't want to code something like that, then your best option is to buy more user sessions if shorting the time out still leaves open too many orphan sessions.
