Without Max-Age a session cookie can remain in the browser for a pro-long time. This increases risk of session hijack.

Remediation

Specify Max-Age and set it to a shorted span of time a cookie should remain in the browser.

Metadata

• Severity: informational
• Slug: session-cookie-with-no-maxage

CWEs

• 613: Insufficient Session Expiration

OWASP

• A02:2021: Cryptographic Failures