Thanks, but I think you have missed the point of the question. I did state that the expiry time was set at 5 mins. What I need to know is, how does CGI::Session decide whether a user has been active or inactive. Application code is not an issue as such.