I am looking for an event to automatically logout a user from the application. Typically I would do it when an inactive session expires. I was wondering if it is secure to do so using cookies. So here are my questions,
Session state within an application should ideally be managed server-side from a security perspective.
So in terms of expiry a list of active sessions should be stored and they should be removed from the server after an agreed period of inactivity (exactly what this would be depends on the application sensitivity, user base etc)
The application should also offer an explicit logout facility which terminates the users session server-side.
If you rely on a client-side measures (e.g. cookie expiry) there is always the risk that an attacker will get access to a cookie and replay it after the expiry has passed. If your application is unable to tell whether that cookie should still be valid then this may expose it to unauthorised access.
In this case the use of cookie flags (e.g. secure, httpOnly) may reduce the risks of an attacker compromising a user's session token, but don't remove the central issue that the server can't tell whether the cookie should still be valid or not.
It is possible to handle session expiry without holding state on the server by using cookies which are protected from tampering and store the expiry date/time within them (e.g. ASP.NETs default session management) but this suffers from the weakness of making it hard to allow users to explicitly terminate the session prior to the time stored in the cookie.
