Is it a vulnerability when the cookie is not invalidated when I close my browser?

  • It depends on the cookie. If it's a session cookie without the session attribute set, it is an issue. – Jeroen Dec 4 at 18:00
  • @Jeroen can you elaborate? Why an issue? What do you mean with "the session attribute"? Any references? – eckes Dec 4 at 20:58
  • @eckes There are cookies that expire at end of session and cookies that expire at a give date:time – curiousguy Dec 4 at 22:06
  • @curiousguy yes, i know. But I don't know a "session" attribute. Thought I missed something like httponly, secure, samesite, ... – eckes Dec 4 at 22:57
  • @eckes Session means without a defined "past use date". The browser only keeps it until the end of the "browsing session" which is not very strictly defined: the session can stay as long as you keep any browsing window opened; or even past restarting the browser if its configured to restart in the same state. – curiousguy Dec 4 at 23:19