Yes. Unless you have a particular need for sessions to survive a browser restart, omit the
That is governed by your actual session expiry time, which should be implemented on the server-side alone. If you do use an
Generally, session-only (no-
Typically there will be a session management tool included in whatever your web framework is on the server-side that will work this out for you by sending the appropriate
That bit of advice aside, your assumption is mostly correct. If there is no expiry set on the cookie, then it is a session cookie and will live as long as the browser is open, and the sessionid is valid. If the server expires the authenticated sessions periodically, then the cookie will no longer be attached to a session on the server and will therefore be essentially null.
And lastly to your third question, what is an appropriate amount of time before expiring a session? It depends entirely on your application. Financial applications often have very short timeouts of five or ten minutes. Many applications have a more traditional default time out of 20 or 30 minutes. If the workflow of your app requires extensive amount of time on a page without refreshing, even longer may be in order. I don't know that it's terribly important in any case, unless your application has specific security needs.
I'm not a web developer so this could be wrong but I would expect that you could just use the
You should also be expiring sessions on the server both when the user logs out and after a certain period of inactivity from the user. The period you choose is a tradeoff between security and usability. The default in PHP is 1440 minutes.