A session cookie is an HTTP cookie set without an Expires or Max-Age attribute, so the browser deletes it when the current session ends. Cookies let a server keep state, such as a login, over HTTP, which is mostly stateless. In scraping, a cookie jar stores these cookies so every later request in the same task sends them back.

The browser decides when the current session ends. Some browsers restore sessions on restart, which can keep session cookies alive indefinitely. Cookies that set Expires or Max-Age are permanent cookies, and when both attributes are set, Max-Age takes precedence.

  • No Expires or Max-Age: This is what makes a cookie a session cookie. RFC 6265 says the user agent must remove these cookies from its cookie store when the session ends.
  • Secure: Limits the cookie to secure channels, such as TLS connections.
  • HttpOnly: Limits the cookie to HTTP requests, so browser scripts cannot read it.
  • What a cookie jar is: A client-side store that saves cookies from responses and returns them in later requests. Python's http.cookiejar module provides one, and it expires stored cookies automatically.
  • Sessions in code: A requests Session object persists cookies across all requests made from it and reuses connections through connection pooling.
  • Saving to disk: MozillaCookieJar saves cookies in the cookies.txt format, which curl also uses. Session cookies are not saved unless you pass ignore_discard=True.
  • With proxies: Pair a cookie jar with a sticky session when a multi-step task needs the same cookies and the same exit IP from start to finish.

Session IDs and Session Hijacking

  • What the cookie carries: Usually a session ID that the server assigns when the session is created. OWASP recommends cookies as the way to exchange it.
  • Why it matters: After login, the session ID is temporarily equivalent to the strongest login method the site uses.
  • Hijacking: If an attacker obtains the session ID, they can fully impersonate the user. OWASP calls this session hijacking, or sidejacking.
  • Hardening: The value should be meaningless and have at least 64 bits of entropy. OWASP also says session cookies must set SameSite=Strict or SameSite=Lax.
  • Do not rely on closing the browser: OWASP advises against relying on browser closure to end a logged-in session.

EU rules (Article 5(3) of the ePrivacy Directive) require consent for cookies unless they are strictly necessary for a service the user explicitly requested. The Article 29 Working Party's Opinion 04/2012 says authentication cookies are usually session cookies and are exempt for the duration of a session. Session-based user input cookies, such as a shopping cart, are exempt on the same basis. Persistent login cookies that keep a user signed in across browser sessions are not exempt.