I've seen a lot of sites that recommends that you close your browser window to log out (thus deleting this cookie), but that wouldn't unset the logged-in state on the server side. If the users doesn't explicitly click the log out button (they just closes the browser window instead), a man in the middle could catch and re-use that session even after the original user closed the browser window (and thought they logged out).
Wouldn't that also mean that using transient cookies for session management potentially could teach your users that they don't need to explicitly log out - and thus increase the potential effectiveness of a MITM? If the user re-opened the browser and found that they're still logged in, it would teach them that only an explicit logout action will log them out.
So, should i avoid using transient cookies for session management for this reason?