Note that modern web browsers do not define a session end as "when you close your browser" unless you hunt for and enable settings to make them do that. Session cookies will happily survive a browser restart by default, because browser makers know that most users don't consider closing their browser to be ending any kind of session.

I think some developers will interpret the term "session cookie" differently then that, because a "session" is usually just something that's tracked in a backend, and an identifier for this session is often written in a cookie

Hence... Session cookie, even if set without expiration date

Session cookies are cookies that identify a session. They last however long you specify. A bank forces quick session expiry. Amazon doesn't.

Compare https://docs.djangoproject.com/en/5.2/topics/http/sessions/ .

> To use cookies-based sessions, set the SESSION_ENGINE setting to "django.contrib.sessions.backends.signed_cookies".

> When using the cookies backend the session data can be read by the client.

> A MAC (Message Authentication Code) is used to protect the data against changes by the client, so that the session data will be invalidated when being tampered with. The same invalidation happens if the client storing the cookie (e.g. your user’s browser) can’t store all of the session cookie and drops data.

I set my browser to clear cookies on exit so that my cookies cannot be stolen by malware.