I'm guessing it's the browsing session, so if I don't set an expiration date this will be used as the default, right?
Yes. Unless you have a particular need for sessions to survive a browser restart, omit the
expires parameter so that the cookie is browser-session-only and not persisted to disc.
does it depend on how long I want users to stay logged in before automatically logging them off
That is governed by your actual session expiry time, which should be implemented on the server-side alone. If you do use an
expires time you would generally want it to be at least as long as the server-side timeout, but you shouldn't rely on the browser honouring that
expires as your method of ensuring old sessions are unreachable.
Generally, session-only (no-
expires) cookies are used for session-tracking, with timeout happening on the server side. If a request is made with an unrecognised or missing cookie, then likely the session has expired at the server side, the browser has been closed at the client side, or both, and you should direct the user to start a new session.
Typically there will be a session management tool included in whatever your web framework is on the server-side that will work this out for you by sending the appropriate
That bit of advice aside, your assumption is mostly correct. If there is no expiry set on the cookie, then it is a session cookie and will live as long as the browser is open, and the sessionid is valid. If the server expires the authenticated sessions periodically, then the cookie will no longer be attached to a session on the server and will therefore be essentially null.
And lastly to your third question, what is an appropriate amount of time before expiring a session? It depends entirely on your application. Financial applications often have very short timeouts of five or ten minutes. Many applications have a more traditional default time out of 20 or 30 minutes. If the workflow of your app requires extensive amount of time on a page without refreshing, even longer may be in order. I don't know that it's terribly important in any case, unless your application has specific security needs.
I'm not a web developer so this could be wrong but I would expect that you could just use the
Set-Cookie: header in the HTTP response to the AJAX query to set the session cookie.
session_*() functions should handle setting the expiry time correctly for you.
You should also be expiring sessions on the server both when the user logs out and after a certain period of inactivity from the user. The period you choose is a tradeoff between security and usability. The default in PHP is 1440 minutes (24 hours).