Inadvertant Session Hijacking

Now this is not the malicious kind where a user intentionally takes over another session. I'm speaking of a case where the random session ID generator happens to give another user someone else's session whether active or inactive (inactive and not yet cleared by garbage collection). I had a case just this weekend where this happened, a user got another visitor's shopping cart. The potential is for someone to get another person's logged in session. The site I work with gets 5,000 unique visitors a day, it's a very very busy website and I'm thinking that garbage collection isn't up to snuff or that the random ID generation isn't quite random enough. What can I do about this? I have increased the percentage of garbage collection already, what else can I do? -- Thomas Deliduka IT Manager ------------------------- Xenocast Street Smart Media Solutions http://www.xenocast.com/