I'm trying to find some information about potential security risks with allowing long lasting cookies for website authentication.
Initially it was set to not persist the login session, so it would only last until the browser was closed. However we've recently changed it to persist for a couple of weeks.
I can see how it would be convenient for users to not have to re-authenticate frequently, but are there fundamental security issues with having the sessions last for perhaps a couple of months instead of weeks? Does a longer expiry for a cookie increase the chances of it being somehow compromised?