Would cookie always change when browser changes?

Question

I have been told that when the browser changes, the cookie will also change. If a user uses same machine, same IP, but different browser, is there any case that the cookie could stay the same? Or it's more likely that the cookie got stolen and the attacker simply pretend to use the same cookie, same IP?

Answer 1

From the server's perspective: When the browser changes, the cookies will of course change, because cookies are stored by the browser and not shared between different browsers by default (it's possible to import them from one browser to another, but most browsers not only store cookies in unique locations but use different storage formats). Even on the same machine and from the same IP address (note: client IP addresses are completely irrelevant to cookies), if the user changes browsers then the cookies they send to the server will also change, because the new browser has a different set of stored cookies (sometimes called "cookie jar").

The server may have ways to tell that it's the same user anyhow, though. The obvious and most reliably one is if the user logs into the same account on the new browser or performs some other act of authentication (proving their identity). The server could also guess, though, based on things like the IP being the same (especially if the browsers both send some OS, machine, and/or plugin details - as they commonly do - and those match too). However, the server would have to actively try to make that match itself; the browser wouldn't just tell the server "hey, I'm the same browser as a minute ago". That's what cookies do, and they aren't shared between browsers.

From the user's perspective: Changing browsers is one reliable way to leave your current cookies behind. Other ways include explicitly deleting/clearing cookies, switching browser profiles (where available), switching OS (Mac/Windows/Linux/etc.) user accounts, switching physical machines (unless both are signed into a service that "roams" your cookies between machines), or using Private/Incognito browsing. On very well-behaved sites, logging out entirely / using a "forget me" feature will also delete your cookies (for that site, obviously not for all sites) but this is not reliable from the user's perspective. Closing all browser windows / rebooting the computer will delete some cookies ("session cookies", the ones without an explicit expiry) but not others (called "persistent" cookies, though these days the session cookies may outlive persistent cookies with an expiry of less than years because nobody closes browsers anymore).

Now, if the user uses the new browser (or private browsing or whatever) to do something that tells the server "hey, I'm the same person as before" (like logging into the same account on the same site), the server can tell they're the same, as mentioned above. The server might, in that case, choose to give the new browser the same cookies as the old one. However, this is not a good practice, and should be quite uncommon. Every user session (the combination of site + user + browser session, the last being the thing that stops when you close all open windows of any one browser and which is not shared between browsers even if they're open at the same time) should use unique cookies; this allows the server to track what the user is doing with more granularity, sign out of one session but not another, and offer the user a list of all active sessions (and the ability to sign out of specific ones without signing out of the current one).

Answer 2

Browser cookies contain only what the server sends to your browser.

If the server can tell that you're the same user using multiple browsers, then the server can send the same cookies to each of your browsers.

I suspect that you're asking about session cookies. Most well configured servers will send a completely unique session ID each time a new session is started, and browsers will delete session cookies when they are closed.

There is no technical requirement that a server send a unique session ID in its cookies; nothing except decent security, reasonable session handling defaults on the web-platform's part, and common sense enforces this behavior on the server.