Chrome doesn't delete session cookies

205
votes

I'm trying to set session cookie in javascript like this:

document.cookie = 'name=alex; path=/'

But Chrome doesn't delete it even if I quit browser and launch it again.

I checked in Firefox and Opera and both work as intended - they delete session cookie on browser exit.

Is Chrome just ignoring expiration rules?

I checked in multiple OSes and found out that session cookie gets removed on Chrome in Windows XP and Ubuntu, but NOT in Mac OSX Lion.

13
javascriptsessiongoogle-chromecookies
It was exactly as in my post i.e. without expiration, not sure about Httponly. I'm not trying to delete it by hand. The problem is browsers should delete it on exit but Chrome just doesn't do it. – mgs
>>> and found out that session cookie gets removed on Chrome in Windows XP. No. In Windows XP Chrome doesn't delete cookie too. I use now Windows XP and have found your question because have got the same problem. The only difference is that I use ZF2 and set session options through Session package. But it is usual php way anyway - ini_set("session.cookie_lifetime", 0) and 'remember_me_seconds' => 1. But doesn't help. Firefox works fine, but Chrome doesn't. – Green
not working for me , session cookie not clear after exit , chrome v85 – Jack Ng

13 Answers

25
votes

I just had the same problem with a cookie which was set to expire on "Browsing session end".

Unfortunately it did not so I played a bit with the settings of the browser.

Turned out that the feature that remembers the opened tabs when the browser is closed was the root of the problem. (The feature is named "On startup" - "Continue where I left off". At least on the current version of Chrome).

This also happens with Opera and Firefox.

21
votes

I just had this issue. I noticed that even after I closed my browser I had many Chrome processes running. Turns out these were each from my Chrome extension.

Under advanced settings I unchecked 'Continue running background apps when Google Chrome is closed' and my session cookies started working as they should.

Still a pain in the rear for all of us developers that have been coding expecting that session cookies would get cleared when the user is done browsing.

12
votes

I had to both, unchecked, under advanced settings of Chrome :

  • 'Continue running background apps when Google Chrome is closed'
  • "Continue where I left off", "On startup"
11
votes

This maybe because Chrome is still running in background after you close the browser. Try to disable this feature by doing following:

  1. Open chrome://settings/
  2. Click "Show advanced settings ..."
  3. Navigate down to System section and disable "Continue running background apps when Google Chrome is closed". This will force Chrome to close completely and then it will delete session cookies.

However, I think Chrome should check and delete previous session cookies at it starting instead of closing.

3
votes

A simple alternative is to use the new sessionStorage object. Per the comments, if you have 'continue where I left off' checked, sessionStorage will persist between restarts.

2
votes

I had the same problem with "document.cookie" in Windows 8.1, the only way that Chrome deletes the cookie was shutting it from task manager (not a really fancy way), so I decided to manage the cookies from the backend or use something like "js-cookie".

1
votes

Have you tried to Remove hangouts extension in Google Chrome? because it forces chrome to keep running even you close all the windows.

I was also facing the problem but it resolved now.

-1
votes

Go to chrome://settings/content/cookies?search=cookies

Enable Clear cookies and site data when you quit Chrome.

Worked for me

-2
votes

If you set the domain for the php session cookie, browsers seem to hold on to it for 30 seconds or so. It doesn't seem to matter if you close the tab or browser window.

So if you are managing sessions using something like the following it may be causing the cookie to hang in the browser for longer than expected.

ini_set("session.cookie_domain", 'www.domain.com');

The only way I've found to get rid of the hanging cookie is to remove the line of code that sets the session cookie's domain. Also watch out for session_set_cookie_params() function. Dot prefixing the domain seems to have no bearing on the issue either.

This might be a php bug as php sends a session cookie (i.e. PHPSESSID=b855ed53d007a42a1d0d798d958e42c9) in the header after the session has been destroyed. Or it might be a server propagation issue but I don't thinks so since my test were on a private servers.

-2
votes

I just had this problem of Chrome storing a Session ID but I do not like the idea of disabling the option to continue where I left off. I looked at the cookies for the website and found a Session ID cookie for the login page. Deleting that did not correct my problem. I search for the domain and found there was another Session ID cookie on the domain. Deleting both Session ID cookies manually fixed the problem and I did not close and reopen the browser which could have restored the cookies.

-3
votes

The solution would be to use sessionStorage, FYI: https://developer.mozilla.org/en-US/docs/Web/API/Window/sessionStorage

-9
votes

Google chrome has a problem if you set and unset cookie improper way. This is php code. Thought this will give you idea.

Set cookie

setcookie('userLoggedIn', 1, 0, PATH);

Wrong way and will not work (notice PATH is missing)

setcookie('userLoggedIn', 0, time()-3600);

Correct way fixes issue on google chrome

setcookie('userLoggedIn', 0, time()-3600, PATH);