i have a nagging issue, which is all over the internet but i couldn’t find a specific solution to my problem. Here it is:
In Chrome, you have the option to “Continue where i left off” on browser startup. This unfortunately means that all session cookies are preserved on browser close and restored or browser startup. I need my client-side (Javascript) application to kill the cookie once the browser is closed, but that doesn’t happen even if i don’t set up an expiry date (so the cookie becomes a session cookie, even Chrome says it expires when the browsing session ends). Problem is that Chrome never kills the browsing session even if i close the browser or reboot the computer, because of that darn startup setting.
One way is to specify an expiry date 15 minutes (or whatever) into the future. On each user action, the cookie’s expiry date gets refreshed (re-create cookie). On user inactivity more than 15 minutes (or whatever) the cookie dies. I cannot afford the 15 minutes open for another person to open the browser and find himself in the previous person’s session, and i can’t have the current user log in after every time he goes to the loo. So i need exactly this: user logs in, cookie is set and persists exactly until the browser is closed. This is the normal behavior of a session cookie, but… (previous paragraph).
I also thought about deleting the cookie on window unload() event, but what if the application is opened in multiple tabs and the user only closes one of them? I could poll the existence of the cookie once per second, and having the cookie always saved in a Javascript variable then i could restore the cookie (if needed) once a second if the user closes another tab. This would keep the cookie alive until the last tab with my application is closed, i.e. browser quit. This is my best current solution but i hate it.
Does anybody know of another (cleaner) way to achieve the same thing? Is there some way i can specify Chrome (and/or other browsers) that i don’t care about the user’s startup setting, my cookie is supposed to die on browser close?
I hope i’ve made enough sense 🙂
Thank you
The whole point is that this is a user option. It is not an application option. Your application has absolutely no business attempting to work around it, and should treat the scenario as if the user really were in the same session.