On 05/04/2013 08:24 PM, Bruce Momjian wrote:
> On Sat, May 4, 2013 at 08:19:38PM +0200, Stefan Kaltenbrunner wrote:
>> hmm pretty sure that browsers are supposed to clear session cookies if
>> they are restarted otherwise you will create bad security issues.
>> Consider logging in to a some site with personal information, close your
>> browser hand over your laptop to somebody in the family for a quick
>> browsing session and he will automatically log in to whatever site you
>> been at before...
>
> Well, if I just go to gmail.com, it certainly knows I am bmomjian. If I
> go to slashdot.org, it knows I am bmomjian too. I have to explicitly
> log out if I want be logged out.
erm - I guess those are using persistent (tracking) cookies(as in you
clicked on "keep me signed in" at one time) vs classic session cookies,
are you proposing we should impose persistent cookies on our users?
Stefan
