Friday, February 17, 2017

Closing Chrome does not delete session cookies

Traditionally, closing browsers automatically deletes "session" cookies. (Cookies that are defined to represent a login session that should be automatically disconnected when a browser closes.)

In 2012, Chrome changed its behavior so that closing the browser does not delete session cookies. (This newer behavior is active if you enable the common Chrome setting: On startup: Continue where you left off.) This new behavior allows reopening the browser (perhaps hours later, by another person) and having your last active pages, along with any associated login sessions, automatically reloaded. (To be fair, many sites will timeout your session if it seems inactive after a short period of time. But many, e.g., GMail, won't.)

This is a bad thing if you use Chrome on a public access computer (e.g., library). You should now explicitly logout of all sites before closing Chrome. Which means you should be careful not to accidentally navigate away from a logged in site and subsequently forget to navigate back and explicitly logoff.

The pros & cons of this new behavior are discussed in the Chrome bug tracker Issue 128513. It seems primarily useful when Chrome restarts to apply software updates (without forcing you to logoff all your websites). Firefox has similar behavior which is also debated. As pointed out there, this browser behavior is at odds with the documented behavior of session cookies.

There is a Chrome setting to force delete all cookies when the browser is closed. (The "Keep local data only until you quit your browser" option described here.) Unfortunately, this is overkill in most situations.

Bottom line: Be aware.