When are session cookies deleted by the browser?
asp.net, browser, cookies, http, session-cookies
Solution
To quote RFC 6265:
If a cookie has neither the Max-Age nor the Expires attribute, the user agent will retain the cookie until "the current session is over" (as defined by the user agent).
And:
The user agent is not required to retain the cookie for the specified duration. In fact, user agents often evict cookies due to memory pressure or privacy concerns.
So: your mileage may vary.
Problem
If I set a cookie as a session cookie (no expires/max-age value), when does the browser remove the cookie? I know that it is removed when the browser is closed but I'd like to know if there is ever a case where a session cookie can timeout or expire before the browser is closed.