We have an issue where sessions are ending after a short time, 1440 seconds according to gc_maxlifetime settings which seems consistent with the issue. The PHPSESSID says it will expire when the session ends - I guess when the browser closes? I suppose before then though the GC is cleaning out expired sessions so the PHPSESSID, which outlives the session on the server, matches no session. Is that right? I guess a new PHPSESSID cookie is issued when the session is re-created?
Extending the sessiongc.maxlifetime is one option, we need to consider how the live site will handle the additional session data on the server. Moving sessions to Redis is an option here too.
Alternatively, in addition, is it possible to regenerate the session without losing session data? For example, each time the user opens a page we'll assume they are still active - so regenerate the session thus extending it's lifetime again to the 1440 seconds (or whatever we extend to). So, even if we have a short duration session the session is only destroyed when the user remains inactive (makes no more page loads) for that duration of time - so if I continue to click every 10 minutes even I'll never be signed out.
I'd also like to note we have millions of page views, and a few thousand authenticated users at any given time. So simple extending gc_maxlifetime is something we have to tread carefully with I think.