I have been told that when the browser changes, the cookie will also change. If a user uses same machine, same IP, but different browser, is there any case that the cookie could stay the same? Or it's more likely that the cookie got stolen and the attacker simply pretend to use the same cookie, same IP?

  • Is there an underlying question here? Do you want to pin sessions to user agents? – Sjoerd Mar 5 at 19:16
  • Are these cookies meant to identify a user, or to describe user preferences (like "number of search result", "show panel on left/right/none"...) – curiousguy Apr 5 at 6:12
  • No, it's not, but just the cookies used by browsers – Cherry Wu Apr 5 at 19:41

Browser cookies contain only what the server sends to your browser.

If the server can tell that you're the same user using multiple browsers, then the server can send the same cookies to each of your browsers.

I suspect that you're asking about session cookies. Most well configured servers will send a completely unique session ID each time a new session is started, and browsers will delete session cookies when they are closed.

There is no technical requirement that a server send a unique session ID in its cookies; nothing except decent security, reasonable session handling defaults on the web-platform's part, and common sense enforces this behavior on the server.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.