Jetty version(s)
Jetty 12.0.5

Jetty Environment
ee10

Java version/vendor (use: java -version)
openjdk 21.0.2

OS type/version
Windows 11

Description
When using the (JDBC)SessionDataStore the orphaned sessions are deleted only on server restart, never at runtime. I tracked it down to org.eclipse.jetty.session.AbstractSessionDataStore, line 297 ff. The field _lastOrphanSweepTime is always set to the current time, even if the if condition is false. The default scavenge interval is 10 min and so _gracePeriodSec needs to be < 1 min for entering cleanOrphans. But by default it is 1 hr.

I suggest to insert the try { } catch under the if statement like this:

if (now > (_lastOrphanSweepTime + TimeUnit.SECONDS.toMillis(10 * _gracePeriodSec)))
{
    try
    {
        if (LOG.isDebugEnabled())
            LOG.debug("Cleaning orphans at {}, last sweep at {}", now, _lastOrphanSweepTime);
               
        cleanOrphans(now - TimeUnit.SECONDS.toMillis(10 * _gracePeriodSec));
    }
    finally
    {
        _lastOrphanSweepTime = now;
    }
}

How to reproduce?
Reproducable when using the JDBCSessionDataStore with default grace period and default scavenge interval of the housekeeper.