There is another lifetime setting which specifies after which time the server may remove the session to avoid to many stale sessions hogging the server's resources.
Quoting from the manual:
session.gc_maxlifetime
specifies the number of seconds after which data will be seen as 'garbage' and potentially cleaned up. Garbage collection may occur during session start (depending onsession.gc_probability
andsession.gc_divisor
).