2

I always used to automatically delete session cookies when i close the browser. Having to retype passwords every time is a little annoying though. How safe is it not to clear session cookies once you're done browsing? There is a lot of material online about session cookies, but not whether it's safe to keep them on the same computer. What are the security implications and concerns on this? Thanks.

2

Some browsers now provide the facility to suspend and resume a session when the browser is closed with open tabs. In my experience this retains session cookies (that is to say, cookies without an expiration date, normally expected to be deleted when the browser exits).

Further, not all sites use session cookies to identify sessions in the application - some use short-lived conventional cookies meaning that even if you close the tab before shutting down the browser, it will be possible to resume the session for such services.

Hence in both scenarios, someone with access to the browser (and user account on the client) can access the session.

  • Session cookies in Chrome are referred to as "Local Data": Settings -> Content settings. If clicking "Allow local data to be set (Recommended)" then session is retained even after closing the browser, or even the computer. I'm asking whether that makes my account data less safe. (not just in Chrome, any browser). Suppose that access to my computer and user account is impossible (they have to break in my quarters to do that and if that happens my account data will probably be the least of my concerns). – Nikos Apr 23 '17 at 13:25
2

As a rule, cookies don't (shouldn't) contain long term secrets (like passwords). Instead they contain a random ID that links your browser to a record that the server maintains with the information it needs to remember you. So the link between you and the identifying information is broken when either of you (you or the server) stops using the ID in the cookie.

Best practice from the server's point of view is to assume that the user is going to do nothing special to protect themselves. So if they're doing their job right, you shouldn't have to do anything at all. They manage the lifecycle of theses IDs, and once they expire the ID on their end, your cookie is meaningless.

But usually session cookies are assumed to be deleted by the browser when the browser is closed, so the length of a "session" is supposed to be one sitting. Now that computers usually suspend instead of shut down, this is less true, leading to a situation where one "sitting" can last months.

What you do with this is up to you. Many websites are (poorly) written to assume that as long as the session cookie is valid, then the computer hasn't left your possession. So if your computer may end up in someone else's hands, then you should definitely make sure that the session cookies get deleted.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.