Android browser and browser do not delete session cookies on device reboot

Question

When I restart my Android device (make a fire) or kill the application, it looks like the cookies of the browser or WebView 'session' are not deleted. This seems to be very different from the behavior of browsers on Windows or MacOS, where the "session" cookies disappeared if you killed the browser application. Only persistent cookies should remain after the browser restarts. To clarify, the session cookie value here is a cookie set by the server without an expiration date using the HTTP header in the response, for example: Set-Cookie: mycookie = ifmr0846qcsdpeqqkgvuqmc5u7; Path = / Since no expiration date is specified, browsers usually do not save them, save them until the process is killed, based on my understanding. Typically, session identifiers are set using this type of cookie.

I am convinced that they are not deleted when the device is rebooted or the application is restarted, because if I enter my website by creating a session (in this case using an inactive / 'session' cookie for the session identifier called PHPSESSID), then reboot the device and open the browser or WebView to the same URL, I'm still registered, which means that the browser still sent the same PHPSESSID cookie that the server set before the device rebooted.

Can someone explain / confirm this behavior for Android web browsers or browser? How do they accurately manage session and persistent cookies?

thanks.

Answer 1

You are correct, the session cookie does not expire automatically in the WebView life cycle. If you see problems with this, you can always clear all cookies or overwrite session cookies explicitly with a blank value.

link: Session cookie life cycle in Android WebView / CookieSyncManager

to clear the use session

CookieManager.getInstance().removeSessionCookie(); CookieManager.getInstance().removeAllCookie();