I was recently trying to figure out exactly how long my users' sessions were lasting on an existing Drupal site that I had built. Generally it seemed like users were remaining logged in for an extremely lengthy period of time. I did some research and finally discovered that this setting is actually configured in the default settings.php file that ships with Drupal. There's a line in the settings file that initially reads:

ini_set('session.cookie_lifetime',  2000000);

read more