CODEWITHSUNDEEP
asp.nethttpcookiesbrowsersession-cookies
Evan
Evan

Reputation: 6123

When are session cookies deleted by the browser?

If I set a cookie as a session cookie (no expires/max-age value), when does the browser remove the cookie?

I know that it is removed when the browser is closed but I'd like to know if there is ever a case where a session cookie can timeout or expire before the browser is closed.

Upvotes: 11

Views: 6119

Answers (1)

CodeCaster
CodeCaster

Reputation: 151586

To quote RFC 6265:

If a cookie has neither the Max-Age nor the Expires attribute, the user agent will retain the cookie until "the current session is over" (as defined by the user agent).

And:

The user agent is not required to retain the cookie for the specified duration. In fact, user agents often evict cookies due to memory pressure or privacy concerns.

So: your mileage may vary.

Upvotes: 14

Related Questions