9
I don't know if this is a bug or what, but in the very least, sessions work different than in 1.3.x. In 1.3.x I set the session expiration for 2 weeks in hopes that it would prevent users from having to re-log in each time they visit, though there was a reported bug in that it would still expire after the expiration time. However, while the user was logged in, but not active, they did not show on the who's online block.
However, in xoops2, I set the session timeout for 2 weeks, and I get logged out within a day, but it still shows me logged in on the who's online block. While I am browsing with that same browser, I will stay logged in, but if I open a new browser, I will have to log in again. But if I have no browsers open, then open one and browse to the site, I will be logged out but shown in the who's online block.
I haven't had a chance to play with the settings yet, but I am using all default settings on the session settings, except for the cookie names.