Through a monitoring tool, I'm noticing that my application has a considerable user session leak. Each day, about a thousand user sessions are created, with none being destroyed. To take the sessions from memory, you need to restart the application server.
In addition to the timeout of the session not being defined, what else could cause a session leak?