I'm trying to find some information about potential security risks with allowing long lasting cookies for website authentication.

Initially it was set to not persist the login session, so it would only last until the browser was closed. However we've recently changed it to persist for a couple of weeks.

I can see how it would be convenient for users to not have to re-authenticate frequently, but are there fundamental security issues with having the sessions last for perhaps a couple of months instead of weeks? Does a longer expiry for a cookie increase the chances of it being somehow compromised?

1 Answer 1


By limiting the time an authentication cookie is valid you are also limiting the time an attacker has access to an account if he/she manages to steal said cookie (given that there are no other countermeasures in place).

It also limits the amount of time an unauthorized person can access said account on e.g. a shared system in case the victim forgot to logout.

So if there are appropriate countermeasures against session hijacking and similar attacks, longer (unlimited) cookie lifespans should not be a problem.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .