5 ms·
> Cookies are given a maximum lifetime of 7 days for cookies set through Javascript and 6 months for cookies set through HTTP What the hell, I don't want my lo
by Dwedit 4y ago
> Cookies are given a maximum lifetime of 7 days for cookies set through Javascript and 6 months for cookies set through HTTP
What the hell, I don't want my logon cookies to expire so quickly.
- polski-g 4y agoThis might be why my browser is constantly logged out of SteamPowered.com
- PufPufPuf 4y agoNope. Same problem on Firefox. Steam just loves logging you out.
- forgotusername6 4y agoDo you mean if you open up a website you used two weeks ago you still want to be signed in? For a website you visited daily the cookie could be refreshed.
- tetromino_ 4y agoDepends. A banking website? No, a quick automatic signout is obviously safe and correct. An entertainment site, a forum, some kind of social media? Certainly I want to stay signed in.
- 9dev 4y agoTo the contrary, why would you want to be signed out? Your account, and therefore by extension, your cookies, should only be usable by you. I cannot think of a reason why I would want to loose my sessions every other day.
- stjohnswarts 4y agoIf you're religious about locking your phone/PC then you probably don't have anything to worry about otherwise someone could easily just see what you have going on in your browser
- stjohnswarts 4y agoHave the best of both worlds with cookie autodelete plugin :) . It's one of the first things I install (along with ublock origin and bitwarden)
- MockObject 4y agoTimeouts and expirations are an absolute plague of the modern world. I can count on one hand the number of sites that I want to be logged out from automatically.
- xnx 4y agoEven worse when they lose track of what page you were on when you log back in. (cough Sharepoint cough)
- brnt 4y agoMy browser is configured to not save any state past shutdown. I prefer that login info is not stored in an opaque way in a 'jar' that's hard to control.
- selfmodruntime 4y agoIt‘s not a jar. You can control your cookies perfectly fine. No one but you and the original host can access them.
- brnt 4y agoGo to you list of cookies and tell me which ones keep me logged in to $service. That's hard! Theybset so many. Sometimes even through other domains.
- croshan 4y agoYour logon cookies should be set serverside, with the Secure and HttpOnly flags set, entirely unaccessible by javascript. So they'll last 6 months. When I see cookies set by javascript, their primary purpose seems to be user tracking, not auth.
- matips 4y agoSometimes cookies are used as they were designed - to store data in browser. For example 5etools-mirror-1.github.io. App without cloud storage or user account system. It stores your shortcuts in YOUR cookies, not in the server's DB.
- ris58h 4y agoThat's why we have localStorage.
- jefftk 4y agoLocal storage is also cleared on the same schedule, or else it could be used as a substitute for cookies.
- mazlix 4y agoThat would mean you are sending your shortcuts to the server on every request, localStorage would be much better in that case to save bandwidth.
- CobrastanJorji 4y agoI think if convenience measures favorably against even minor security concerns in nearly any situation, you are probably not the target audience for specialty security-focused web browser projects.