Can I set session time to 10 days without risking security issues?

Question

We have a WordPress form that collects data on what marketing source (UTM) the user came from and upon submission, sends that UTM data to a 3rd party. Recently, a client asked me to have a web session to remember this session data for up to 10 days (default was 15 mins). I have a few questions. ...

1. is there any security risk to doing this? The data itself is not sensitive. We don't have any user logins other than WordPress admins. But seems wrong to set it that long.

2. wouldn't the session data be lost anyway when the user closed their browser? so is 10 days overkill?

3. what am I missing here? is this normal in some cases?

I have googled this but getting responses that are not in line with what I am asking.

Answer 1

Setting a long session duration isn't inherently insecure. The reason why sessions are typically short-lived is because many applications do use them for user authentication, and in this case, the window where an attacker can compromise or misuse the session (e.g., through cross-site request forgery) should be kept as small as possible.

If this does not apply to you, then increasing the duration is valid. However, you have to be careful to only apply the settings to the marketing-related sessions, not all PHP sessions (which would include admin sessions). This means the global php.ini isn't the right place. Instead, either override the default settings on a per-domain or per-path basis through the web server configuration, or increase the duration at runtime. Also note that there is both a server-side setting for the session garbage collector (session.gc_maxlifetime) and a client-side setting for the session cookie (session.cookie_lifetime).

To answer the other two questions:

• The session does not end when the client closes their browser. If session.cookie_lifetime is set to a value bigger than 0, this makes the session cookie permanent, i.e., the browser will not automatically delete the cookie until it has expired. Of course the client is still free to manually delete their cookies whenever they want.

• Yes, long sessions can be valid. The session duration is ultimately a design decision. Even applications which manage sensitive data often have some type of remember-me feature which leads to long-running sessions, because it was determined that the increased usability is worth the additional risk. Of course long-running sessions involving sensitive data should be particularly well-protected (no plaintext session IDs on the server, strict HTTPS-only policy, hardening of the cookie settings against cross-site request forgery etc.).

Answer 2

is there any security risk to doing this?

If your application is used from a business where people lock their computers, there's negligible risk in having longer session timeouts. If your application is used from shared computers in the community library, having short session timeouts can prevent session takeover if someone forgets to log out.

wouldn't the session data be lost anyway when the user closed their browser?

Not necessarily. This depends on how your application handles sessions. It's possible to set session cookies or write to session storage, and these are cleared when closing the browser. However, it's also possible to write session cookies or write to local storage, and these can remain for a long time.

so is 10 days overkill?

I think it's fine. I wrote more about my reasoning in a blog post: Short session expiration does not help security.

Having a long session timeout can introduce a requirements to terminate an existing session. If someone gets fired, for example, they shouldn't have access for 10 days after their termination.