Philip Mak <[EMAIL PROTECTED]> asked:
> I have a general question about websites that use cookies to store session
> information:
>
> Why should they expire at all?
>
> Let me give you an example. Yesterday, I was at Amtrak Rail's website to
> purchase train tickets. Now, I multitask a lot, and sometimes I might
> leave one browser window idle while I go to do something else.
>
> So I'm browsing the possible rides I can get on, then I do something else
> for half an hour. I go back to the browser window with Amtrak, and then
> when I click something it tells me that my session has expired and I'll
> have to login again!
>
> Gritting my teeth, I login again and start the process over. This time I
> finish the reservation and minimize the window.
>
> Later that night, I want to check my reservation again. I maximize that
> window and click something ... oops, session expired again!
>
> I realize that in a computer lab environment, automatic session expiration
> may be needed for security purposes, but I think in the situation
> mentioned above, it was excessive.
>
> What do people think about this?
>
> -Philip Mak ([EMAIL PROTECTED])
Amtrak probably has set the cookie to some internal reference indicator
that remembered your session's information. When you do the next page
they would use the cookies info to fetch your info. Well if I were Amtrak
I wouldn't want to keep around session info for everyone who was looking
forever, just incase they came back. (Most probably never do.)
So they tell the cookie to expire at the same time they delete the
retained info on their system. Nice and clean.
But that's why I'd expire a cookie, if I were Amtrak.
Your milage as well as your application may vary.
-------------------------------------------------------------------------------
Fulko Hew, Voice: 905-333-6000 x 6010
Senior Engineering Designer, Direct: 905-333-6010
Northrop Grumman-Canada, Ltd. Fax: 905-333-6050
777 Walkers Line, Home: [EMAIL PROTECTED]
Burlington, Ontario, Canada, L7N 2G1 Work: [EMAIL PROTECTED]
