Are there any security risks associated with not setting an expiration date for cookies in PHP sessions?

Not setting an expiration date for cookies in PHP sessions can pose a security risk as it can lead to session fixation attacks where an attacker can hijack a user's session. To mitigate this risk, it is recommended to set an expiration date for cookies in PHP sessions to ensure that sessions expire after a certain period of inactivity. 

// Set expiration date for cookies in PHP sessions
ini_set('session.cookie_lifetime', 3600); // expire after 1 hour of inactivity

Keywords

PHP cookies expiration date security risks sessions

Related Questions