CyberCertPrepWeb App FundamentalsCookies & SessionsEASYFree question
A developer uses the HTTP 'Set-Cookie' header and includes 'Expires=Thu, 01 Jan 2099 00:00:00 GMT'. What security concern does a far-future expiry date create?
- A.Far-future dates cause browser parsing errors
- B.Persistent cookies that survive for decades mean a stolen cookie remains valid for an extremely long period; even if the user changes their password or account is closed, the cookie may continue to work if server-side revocation is not implemented
- C.The Expires attribute only matters for session (non-persistent) cookies
- D.A far-future Expires date automatically sets SameSite=None
Why B is correct
Long-lived persistent cookies remain in the browser for years. If stolen via XSS, network interception, or browser file access, the stolen cookie is usable for the duration of its validity. Combined with lack of server-side revocation, this creates a long exploitation window. Best practice: use Max-Age for typical sessions (hours to days for remember-me), and implement server-side revocation that works regardless of expiry.
Know someone studying for Web App Fundamentals? Send them this one.