What Is a Session Cookie?

A session cookie is a small text file that a website stores in your browser's memory only for the length of your visit. It has no expiry date, so the browser deletes it when the browsing session ends, usually when you close the browser. Websites use session cookies to remember things between pages, such as that you are logged in or what is in your shopping cart.

Session cookies are also called transient cookies, temporary cookies, in-memory cookies or non-persistent cookies.

Key Characteristics of Session Cookies

Property	Session cookie
Lifetime	Until the browser session ends
Expiry date	None: no Expires or Max-Age attribute is set
Where it is stored	In the browser's memory, not written to disk as a long-term cookie
Typical content	A random session ID that points to data kept on the server
Typical purpose	Logins, shopping carts, multi-step forms, security tokens, load balancing
Party	Usually first-party, set by the website you are visiting
Consent under GDPR	Not needed if strictly necessary; needed for analytics or advertising

How Do Session Cookies Work?

HTTP is stateless: each time your browser requests a page, the server treats it as a new, unrelated request. Session cookies give the server a way to recognise the same visitor from one page to the next.

1. You open a website. The server creates a session and a random, hard-to-guess session ID.
2. The server sends the ID to your browser in a Set-Cookie header without an Expires or Max-Age attribute. That missing expiry date is what makes it a session cookie.
3. Your browser keeps the cookie in memory and sends it back with every request to the same site.
4. The server reads the session ID and loads your session data, such as your login status or cart.
5. When you close the browser, the cookie is discarded. The server-side session usually times out after a period of inactivity.

Session cookie example

A server response that sets a session cookie looks like this:

Set-Cookie: sessionid=a3fWa9Kx72Lp; Path=/; Secure; HttpOnly; SameSite=Lax

A persistent cookie, by contrast, includes an expiry:

Set-Cookie: lang=en; Path=/; Max-Age=31536000; Secure; SameSite=Lax

In JavaScript, a cookie set without an expiry is also a session cookie:

document.cookie = "step=2; path=/; Secure; SameSite=Lax";

Common session cookie names include PHPSESSID (PHP), JSESSIONID (Java), ASP.NET_SessionId (ASP.NET), connect.sid (Node.js Express) and sessionid (Django).

What Are Session Cookies Used For?

• Keeping users logged in as they move between pages
• Remembering items in a shopping cart until checkout
• Carrying data through multi-step forms and checkouts
• Security, such as CSRF tokens and detecting repeated failed logins
• Load balancing, routing a visitor to the same server during a visit
• Temporary preferences for the current visit, such as a chosen language or currency
• Media player settings, such as buffering state or playback position during a visit

Session Cookies vs Persistent Cookies

	Session cookies	Persistent cookies
Expiry	When the browser session ends	On a set date, or after a set number of seconds
Set with	No Expires or Max-Age	Expires or Max-Age attribute
Storage	Browser memory	Written to disk and kept after the browser closes
Survives closing the browser	No (unless session restore is on)	Yes
Typical use	Login state, cart, security, load balancing	"Remember me", saved preferences, analytics, advertising
Tracking across visits	No	Yes
Consent under GDPR	Often exempt as strictly necessary	Usually required, unless strictly necessary

Many sites use both. For example, a login system might use a session cookie for the current visit and a persistent "remember me" cookie to log you back in next week.

Do session cookies really expire when I close the browser?

Not always. If your browser is set to restore your previous session, such as "Continue where you left off" in Chrome or "Open previous windows and tabs" in Firefox, it may keep session cookies after a restart. Some mobile browsers rarely end a session at all because the app is not fully closed. That is why servers should also expire sessions themselves after a period of inactivity.

Session Cookies vs Session Storage vs Server Sessions

These terms are often confused:

• A session cookie is a cookie with no expiry date. It is sent to the server with every request.
• Session storage (window.sessionStorage) is a browser storage API. It is limited to one tab, is never sent to the server automatically, and is cleared when the tab closes.
• A server-side session is the data a server keeps about a visitor, such as their user ID and cart. A session cookie usually holds only the ID that links the browser to that data.

Learn more in our guide to cookies and local storage.

First-Party and Third-Party Session Cookies

Most session cookies are first-party: they are set by the domain in the address bar and used to make that site work. Third-party services embedded on a page, such as payment widgets, chat tools or video players, can also set session cookies on their own domains. Browsers increasingly restrict third-party cookies, so these are less reliable than first-party ones.

Are Session Cookies Safe?

Session cookies do not contain viruses and cannot run code. They usually hold only a random ID. The risk is that anyone who steals a valid session ID can act as that user until the session ends. This is called session hijacking.

Protect session cookies with these attributes and practices:

• HttpOnly stops JavaScript from reading the cookie, which limits damage from cross-site scripting (XSS).
• Secure sends the cookie only over HTTPS.
• SameSite=Lax or Strict limits when the cookie is sent with cross-site requests, which helps prevent CSRF.
• The __Host- name prefix locks the cookie to your exact domain over HTTPS.
• Generate long, random session IDs and never put personal data in the cookie value.
• Issue a new session ID after login to prevent session fixation.
• Expire idle sessions on the server and invalidate them on logout.

Do Session Cookies Need Consent Under GDPR?

It depends on what the cookie does, not how long it lasts. Under Article 5(3) of the ePrivacy Directive, storing or reading cookies needs prior consent unless the cookie is strictly necessary for a service the user has asked for. The GDPR sets the standard for that consent and applies to any personal data the cookie collects.

The Article 29 Working Party's Opinion 04/2012 on the cookie consent exemption lists typical cookies that do not need consent. Many of them are session cookies:

• User-input cookies, such as a shopping cart or form data, for the duration of the session
• Authentication cookies for the duration of the session
• User-centric security cookies, such as those that detect repeated failed logins
• Multimedia player session cookies
• Load-balancing session cookies
• User interface customisation cookies, such as a language preference, for the session or a few hours longer

A session cookie still needs consent if it is used for analytics, advertising, social media tracking or anything that is not strictly necessary. A short lifetime does not make a tracking cookie exempt.

Even when consent is not required, you must still tell users about the cookies you use, usually in a cookie policy or cookie declaration. The UK PECR, the California CCPA/CPRA and other privacy laws have similar rules about disclosing cookies.

How to Check Session Cookies in Your Browser

1. Open the website and press F12, or right-click and choose Inspect, to open Developer Tools.
2. In Chrome or Edge, go to Application, then Storage, then Cookies. In Firefox, go to Storage, then Cookies. In Safari, go to Storage, then Cookies.
3. Select the website's domain.
4. Look at the Expires / Max-Age column. Session cookies show "Session" instead of a date.

To check all cookies on your site at once, including which ones are session cookies, run a free scan with the UniConsent Cookie Checker.

How to Delete Session Cookies

• Close all browser windows. If session restore is on, turn it off or clear cookies manually.
• Clear cookies for a site from your browser settings, or clear all browsing data.
• Log out of the website, which usually ends the server-side session.
• Use a private or incognito window. All its cookies, session or persistent, are deleted when you close it.

How UniConsent Handles Session Cookies

UniConsent is a Google-certified and IAB Europe-registered Consent Management Platform (CMP). It helps you manage session cookies alongside every other cookie on your site:

• The cookie scanner finds all cookies on your site and records whether each one is a session or persistent cookie.
• Cookies are grouped into categories such as strictly necessary, analytics and marketing, and the cookie declaration is kept up to date automatically.
• Strictly necessary session cookies keep working, while analytics and advertising cookies are blocked until the visitor consents.
• Consent choices are passed to Google Consent Mode v2 and IAB TCF vendors.

Frequently Asked Questions

How long does a session cookie last?

A session cookie lasts until the browser session ends, usually when you close the browser. If the browser restores sessions on restart, it can last longer. The server-side session it points to often times out sooner, commonly after 15 to 30 minutes of inactivity.

Where are session cookies stored?

In the browser's memory. They are not saved as long-term cookies on disk, although browsers with session restore may save them temporarily so they can reopen your tabs.

Can session cookies track me?

A session cookie on its own cannot track you across visits because it is deleted at the end of the session. Within a single visit it can link your page views together, which is why session cookies used for analytics or advertising still need consent under the GDPR.

Are session cookies personal data?

They can be. The GDPR treats online identifiers, such as a session ID linked to a logged-in user, as personal data when they can be used to identify a person.

Should I block session cookies?

It is not recommended. Blocking session cookies will break logins, shopping carts and checkout on most websites. To limit tracking, block third-party cookies and refuse non-essential cookies in consent banners instead.

What is the difference between a session cookie and a session ID?

A session ID is the random value that identifies your session on the server. A session cookie is the most common way to store that ID in the browser and send it back with each request.

Further Reading

• MDN: Using HTTP cookies
• Article 29 Working Party: Opinion 04/2012 on Cookie Consent Exemption
• UniConsent: All About Cookies
• UniConsent: GDPR Compliance Guide
• UniConsent: Cookie Consent Laws