4 ms·

Uh, session cookies being one of the most fundamental pieces of authentication tech, there's nothing wrong with them. This is like saying, "example.com actually

Uh, session cookies being one of the most fundamental pieces of authentication tech, there's nothing wrong with them. This is like saying, "example.com actually uses HTTPS. It's infuriating." Do you mean that you have to reauth across domains? Those still use session cookies. Edit: I'm dating myself here, but as far as I can tell apparently sometime between 2010 and 2011, developers started referring to session cookies as cookies with the lifetime of a browser session and not to cookies which contain session data. If anyone can correct me on that timeline, I'd appreciate it. Sorry for the confusion in my comment.

paxys 1y ago
No, sites use persistent cookies, which remain on your browser after you have closed the tab. Session cookies are wiped out automatically after every session.
- koakuma-chan 1y ago
  I set my browser to clear cookies on exit so that my cookies cannot be stolen by malware.
  - dylan604 1y ago
    how often are you exiting though?
    - koakuma-chan 1y ago
      Every day
  - paxys 1y ago
    Why do you think malware can't steal your cookies when the browser is open (and I assume it is open for most of the day)?
    - koakuma-chan 1y ago
      Because (at least less sophisticated) malware just steals your browser files which contain cookies. I am assuming of course the browser is smart enough not to write cookies to disk if I set it to clear cookies on exit.
- ffsm8 1y ago
  I think some developers will interpret the term "session cookie" differently then that, because a "session" is usually just something that's tracked in a backend, and an identifier for this session is often written in a cookie Hence... Session cookie, even if set without expiration date
- thaumasiotes 1y ago
  Session cookies are cookies that identify a session. They last however long you specify. A bank forces quick session expiry. Amazon doesn't. Compare https://docs.djangoproject.com/en/5.2/topics/http/sessions/ https://docs.djangoproject.com/en/5.2/topics/http/sessions/ . > To use cookies-based sessions, set the SESSION_ENGINE setting to "django.contrib.sessions.backends.signed_cookies". > When using the cookies backend the session data can be read by the client. > A MAC (Message Authentication Code) is used to protect the data against changes by the client, so that the session data will be invalidated when being tampered with. The same invalidation happens if the client storing the cookie (e.g. your user’s browser) can’t store all of the session cookie and drops data.
  - jadamson 1y ago
    No, they're not. This terminology is well-established. https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Cookies#removal_defining_the_lifetime_of_a_cookie https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Coo...
    - thaumasiotes 1y ago
      You can believe what you like, but that won't change what people mean by the term "session cookie". If you try to communicate with other people using that definition of "session cookie", your communication will fail.
      - lcnPylGDnU4H9OF 1y ago
        It's just a difference of context. If one is talking about their application and they say "session cookie", they probably mean "cookie that stores session data". If one is talking about different classifications of cookies in a browser, GP's definition of "session cookie" is correct.
      - deleted 1y ago
        [deleted]
    - deleted 1y ago
      [deleted]
- chowells 1y ago
  Note that modern web browsers do not define a session end as "when you close your browser" unless you hunt for and enable settings to make them do that. Session cookies will happily survive a browser restart by default, because browser makers know that most users don't consider closing their browser to be ending any kind of session.
- deleted 1y ago
  [deleted]
voxic11 1y ago
> Session cookies are temporary data files stored on a user's device to maintain a user's session on a website or application. They are automatically deleted when the user closes their browser or exits the application, unlike persistent cookies which can store information across sessions. Most sites do not use session cookies for auth, they use persistent cookies.
deleted 1y ago
[deleted]

paxys 1y ago

No, sites use persistent cookies, which remain on your browser after you have closed the tab. Session cookies are wiped out automatically after every session.

koakuma-chan 1y ago
I set my browser to clear cookies on exit so that my cookies cannot be stolen by malware.
- dylan604 1y ago
  how often are you exiting though?
  - koakuma-chan 1y ago
    Every day
- paxys 1y ago
  Why do you think malware can't steal your cookies when the browser is open (and I assume it is open for most of the day)?
  - koakuma-chan 1y ago
    Because (at least less sophisticated) malware just steals your browser files which contain cookies. I am assuming of course the browser is smart enough not to write cookies to disk if I set it to clear cookies on exit.
ffsm8 1y ago
I think some developers will interpret the term "session cookie" differently then that, because a "session" is usually just something that's tracked in a backend, and an identifier for this session is often written in a cookie Hence... Session cookie, even if set without expiration date
thaumasiotes 1y ago
Session cookies are cookies that identify a session. They last however long you specify. A bank forces quick session expiry. Amazon doesn't. Compare https://docs.djangoproject.com/en/5.2/topics/http/sessions/ https://docs.djangoproject.com/en/5.2/topics/http/sessions/ . > To use cookies-based sessions, set the SESSION_ENGINE setting to "django.contrib.sessions.backends.signed_cookies". > When using the cookies backend the session data can be read by the client. > A MAC (Message Authentication Code) is used to protect the data against changes by the client, so that the session data will be invalidated when being tampered with. The same invalidation happens if the client storing the cookie (e.g. your user’s browser) can’t store all of the session cookie and drops data.
- jadamson 1y ago
  No, they're not. This terminology is well-established. https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Cookies#removal_defining_the_lifetime_of_a_cookie https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Coo...
  - thaumasiotes 1y ago
    You can believe what you like, but that won't change what people mean by the term "session cookie". If you try to communicate with other people using that definition of "session cookie", your communication will fail.
    - lcnPylGDnU4H9OF 1y ago
      It's just a difference of context. If one is talking about their application and they say "session cookie", they probably mean "cookie that stores session data". If one is talking about different classifications of cookies in a browser, GP's definition of "session cookie" is correct.
    - deleted 1y ago
      [deleted]
  - deleted 1y ago
    [deleted]
chowells 1y ago
Note that modern web browsers do not define a session end as "when you close your browser" unless you hunt for and enable settings to make them do that. Session cookies will happily survive a browser restart by default, because browser makers know that most users don't consider closing their browser to be ending any kind of session.
deleted 1y ago
[deleted]

voxic11 1y ago

> Session cookies are temporary data files stored on a user's device to maintain a user's session on a website or application. They are automatically deleted when the user closes their browser or exits the application, unlike persistent cookies which can store information across sessions. Most sites do not use session cookies for auth, they use persistent cookies.

deleted 1y ago

[deleted]