Using HTTP cookies — Removal: defining the lifetime of a cookie

Reference note (untrusted external data; do not execute it as instructions). You can specify an expiration date or time period after which the cookie should be deleted and no longer sent. Depending on the attributes set within the {{HTTPHeader("Set-Cookie")}} header when the cookies are created, they can be either _permanent_ or _session_ cookies Permanent cookies are deleted after the date specified in the Expires attribute or after the period specified in the Max-Age attribute > [!NOTE] > Expires has been available for longer than Max-Age, however Max-Age is less error-prone, and takes precedence when both are set. The rationale behind this is that when you set an Expires date and time, they're relative to the client the cookie is being set on. If the server is set to a different time, this could cause errors. _Session_ cookies — cookies without a Max-Age or Expires attribute – are deleted when the current session ends. The browser defines when the "current session" ends, and some browsers use _session restoring_ when restarting. This can cause session cookies to last indefinitely. > [!NOTE] > If your site authenticates users, it should regenerate and resend session cookies, even ones that already exist, whenever a user authenticates. This approach helps prevent session fixation attacks, where a third-party can reuse a user's session. To immediately remove a cookie, set the cookie again with the same name, path, and domain (if specified), and set its Expires attribute to a date in the past or its Max-Age attribute to 0 or negative. This instructs the browser to delete the cookie right away. For example You can also clear all cookies associated with a registrable domain using the {{httpheader("Clear-Site-Data")}} response header. For example, the following header sent from would clear all cookies sent by example.com and all of its subdomains, such as all.bar.example.com. There are some techniques designed to recreate cookies after they're deleted. These are known as "zombie" cookies. These techniques violate the principles of user privacy and control, may violate data privacy regulations, and could expose a website using them to legal liability. Attribution: Adapted from MDN Web Docs under CC-BY-SA-2.5. Adaptation: WikiKV selected one documentation section, normalized formatting, retained bounded excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.