4

I am running Chrome with a specific --user-data-dir on removable storage that allows me to maintain a single browser session on different machines throughout the day (history, bookmarks, extensions, etc.)

However I notice that login-cookies for most major websites do not persist across machines. Using a SQLite browser and digging through Chrome's database I can see that Chrome has different cookies for each machine I use. I login on Machine A, then go to Machine B and have to log back in on Machine B. When I return to Machine A, my cookie is still valid and I don't have to re-enter credentials.

My question is: What is the extra factor that forces either the browser or the server to require a new cookie? Is it the IP address of the machine? MAC address or something like that?

Improve this question

3 Answers 3

Reset to default
3

What is the extra factor that forces either the browser or the server to require a new cookie? Is it the IP address of the machine? MAC address or something like that?

It is unknown what the extra factor is in the specific cases but it is not uncommon that the IP address or some kind of browser fingerprint is included in the cookie or attached to it on the server side do defend against session hijacking caused by stealing the cookie. MAC address is not included in such checks because there is no way to get such information from within the browser or from the server.

See also Binding the Session ID to Other User Properties in the Session Management Cheat Sheet from OWASP.

Improve this answer
2

Nothing is forcing the browser to avoid syncing cookies between machines; I suspect you could alter chromium to do so with little effort.

But I also suspect that if you did so you wouldn't get the result you had hoped for. Cookies often retain state more tightly-coupled to your browsing session than you might think; in addition to login state, it could also be tracking in-flight transactions, pending operations, or other active user state.

Further, and more interestingly, it's not uncommon for sites to tie your login state not only to your cookie but also your address; if you show up from a second IP with the original login cookie you may get logged out. Syncing this state across multiple browsers would result in what appears to be an inability to stay logged in, and from the users perspective, it would look like your browser was broken.

I suspect that's the reason why. They probably tried it and it broke everything.

Improve this answer
1

Cookies by definition are only stored on a single machine.

However, in Chrome, you can set your sync properties to include everything including session cookies.

Session cookies preserve your logged-in state on many websites.

Chrome usually makes the right decisions but not always, so I personally only use Chrome sync for Bookmarks.

Then I use Lastpass to make logging in very easy on all the computers.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .