My Django application sets a
set-cookie: sessionid=xxxx; expires=Thu, 16-May-2019 18:54:59 (and some more, like max-age and path) on every response. The sessionid remains the same until the session ends. I can see the purpose of this: By setting the expire time, the time when the browser should drop the cookie can well be controlled, and set to an up to date value every request made.
- A security expert told me, that this is at least "un-normal" behaviour, normally the sessionid cookie should be set on login only, and the server would then just invalidate the cookie if it's no longer valid
- My current configuration is
SESSION_EXPIRE_AT_BROWSER_CLOSE=True(https://docs.djangoproject.com/en/2.2/ref/settings/#std:setting-SESSION_EXPIRE_AT_BROWSER_CLOSE), so, the expire is no more a thing, right, and in theory, setting the cookie after login only would be ok.
But, I from my side see no downside on setting the header on every response - I mean, I pass the sessionid on to the server with every request already, and it just kinda returns it (with up to date expires)...?