Not deleting session cookies.. Is it safe?

Question

I always used to automatically delete session cookies when I closed the browser. Having to retype passwords every time is a little annoying though. How safe is it not to clear session cookies once you're done browsing? There is a lot of material online about session cookies, but not whether it's safe to keep them on the same computer. What are the security implications and concerns on this?

Answer 1

As a rule, cookies don't (shouldn't) contain long term secrets (like passwords). Instead they contain a random ID that links your browser to a record that the server maintains with the information it needs to remember you. So the link between you and the identifying information is broken when either of you (you or the server) stops using the ID in the cookie.

Best practice from the server's point of view is to assume that the user is going to do nothing special to protect themselves. So if they're doing their job right, you shouldn't have to do anything at all. They manage the lifecycle of theses IDs, and once they expire the ID on their end, your cookie is meaningless.

But usually session cookies are assumed to be deleted by the browser when the browser is closed, so the length of a "session" is supposed to be one sitting. Now that computers usually suspend instead of shut down, this is less true, leading to a situation where one "sitting" can last months.

What you do with this is up to you. Many websites are (poorly) written to assume that as long as the session cookie is valid, then the computer hasn't left your possession. So if your computer may end up in someone else's hands, then you should definitely make sure that the session cookies get deleted.

Answer 2

Some browsers now provide the facility to suspend and resume a session when the browser is closed with open tabs. In my experience this retains session cookies (that is to say, cookies without an expiration date, normally expected to be deleted when the browser exits).

Further, not all sites use session cookies to identify sessions in the application - some use short-lived conventional cookies meaning that even if you close the tab before shutting down the browser, it will be possible to resume the session for such services.

Hence in both scenarios, someone with access to the browser (and user account on the client) can access the session.

Update I wrote the above in 2017, reflecting on this in 2024, I think both my answer and that from tylerl miss an important point. That is the question of how the session is managed serverside.

Of course, not all providers implement the best security, so you should not assume that their policy is appropriate nor that the implementation of the policy works. As a provider, you should have a very considered reason for implementing sessions providing access to any authorized resource which do NOT have an inactivity timeout of less than, say, 10 minutes.

Regarding persisting authentication across browser sessions - there are discussions elsewhere about "remember-me" vs session tokens.