CODEWITHSUNDEEP
sessioncookies
Franzech Domâs
Franzech Domâs

Reputation: 249

Why do sessions expire after closing the browser window?

According to Where are $_SESSION variables stored?: "Usually the session-id is stored in a cookie, but it can also be appended to urls". Once I read that, I asked myseld: so, why is it said that the session-id is deleted when closing the browsers window if it is stored in a cookie?

Then, after Googling a little bit more about it, I found that there are two different types of cookies: session cookies and persistent cookies.

I guess that the session-id is stored in a session cookie, but: beyond the name evidence, why is a session stored in a session cookie and not in a persistent cookie? What is the need of creating a new session-id every time the browser is opened? Why don't re-use it?

Upvotes: 2

Views: 3079

Answers (1)

oligofren
oligofren

Reputation: 22993

There are many reasons you store sessions in session cookies. One case is public computers: if the previous user has logged into their bank account at the library to pay bills you don't want the next user to be able to log into that session by just looking at the History log in the browser. Being sure that the session is gone by closing the browser alleviates this.

You can also use persistent cookies, and many do too, such as Gmail, but what is then important is to set an expiration time that is not too long. Otherwise, if someone gets hold of the session id they can use that forever. Usually the server will send you a new valid session id some minutes before the next goes out to keep your session alive.

Upvotes: 1

Related Questions