Hacker News Reader

Comment by Dwedit | Hacker News Reader

> Cookies are given a maximum lifetime of 7 days for cookies set through Javascript and 6 months for cookies set through HTTP

What the hell, I don't want my logon cookies to expire so quickly.

View on HN

Your logon cookies should be set serverside, with the Secure and HttpOnly flags set, entirely unaccessible by javascript. So they'll last 6 months.

When I see cookies set by javascript, their primary purpose seems to be user tracking, not auth.

Sometimes cookies are used as they were designed - to store data in browser. For example 5etools-mirror-1.github.io. App without cloud storage or user account system. It stores your shortcuts in YOUR cookies, not in the server's DB.

That's why we have localStorage.

Local storage is also cleared on the same schedule, or else it could be used as a substitute for cookies.

That would mean you are sending your shortcuts to the server on every request, localStorage would be much better in that case to save bandwidth.

Timeouts and expirations are an absolute plague of the modern world. I can count on one hand the number of sites that I want to be logged out from automatically.

Even worse when they lose track of what page you were on when you log back in. (cough Sharepoint cough)

My browser is configured to not save any state past shutdown. I prefer that login info is not stored in an opaque way in a 'jar' that's hard to control.

It‘s not a jar. You can control your cookies perfectly fine. No one but you and the original host can access them.

Go to you list of cookies and tell me which ones keep me logged in to $service. That's hard! Theybset so many. Sometimes even through other domains.

Do you mean if you open up a website you used two weeks ago you still want to be signed in? For a website you visited daily the cookie could be refreshed.

Depends.

A banking website? No, a quick automatic signout is obviously safe and correct.

An entertainment site, a forum, some kind of social media? Certainly I want to stay signed in.

To the contrary, why would you want to be signed out? Your account, and therefore by extension, your cookies, should only be usable by you.

I cannot think of a reason why I would want to loose my sessions every other day.

If you're religious about locking your phone/PC then you probably don't have anything to worry about otherwise someone could easily just see what you have going on in your browser

Have the best of both worlds with cookie autodelete plugin :) . It's one of the first things I install (along with ublock origin and bitwarden)

I think if convenience measures favorably against even minor security concerns in nearly any situation, you are probably not the target audience for specialty security-focused web browser projects.

This might be why my browser is constantly logged out of SteamPowered.com

Nope. Same problem on Firefox. Steam just loves logging you out.

Reply on news.ycombinator.com