A session cookie is persistent and stays in the browser for a very long time, more than thirty days. A persistent session credential on a shared or stolen device, or in a backup of the browser profile, can be used for as long as the cookie remains valid on the server.

1. Use session cookies (no Expires and no Max-Age) for authentication, so that they disappear when the browser is closed.

2. Limit the server side lifetime of the session and enforce an idle timeout and an absolute timeout.

3. Treat "remember me" separately with a dedicated token that is stored hashed on the server, is rotated on use and gives less privilege than a normal login.

• CWE-613: Insufficient Session Expiration
• OWASP Session Management Cheat Sheet