Power Apps wCookie Management - ASP.NET SessionsID

[michaelgappa1]

Does anyone know or can confirm if the Session ID lifetime on any Power Apps Website can be adjusted? I have found documentation that says its lifetime is session (expires after browser is closed), but I haven't found anywhere that it cannot be adjusted?

Cookies in Power Apps portals - Power Apps | Microsoft Learn

[poweractivate · Accepted solution]

@michaelgappa1 

Please make a note of the following:

Although I do not know the internal implementation here of Portals or Office 365, note that regardless of the client side lifetime of any cookie, if there are any server side validation checks on the age of the cookie from when it was first made by the server's perspective, then one or more such cookies where such validation is performed, after expired on the server side, can no longer be used to perform any further operations regardless of the client side age of the cookie.

Let's suppose it does what you want and the age of every cookie were exactly what you wanted. However suppose the server did not care when any cookie expired. Couldn't you just take any cookie you wanted, and just change the age of it with any client side tool before it expired, and then just wait, and then the server would consider even an expired cookie as valid now? 

Actually, if a cookie's validation were modified on the client side to be longer, and the server still discarded it when it was actually past its real expiration date validated on the server, wouldn't it be a sign that the server was doing a better job in that case not relying just on the client side cookie's timestamps?

So I think reliance on just what the client side tells you of the cookie as a sign of the security strength of a system is not wise. A sign of a vulnerability may very well be the opposite of what you have noted. If all the cookies have all the right dates on your side, but never validates on the server, that's actually a real vulnerability, because you could just change when the cookies expire and that's all it would take to trigger a system vulnerability, right?

Out of curiosity, I would like to know where did you find out that the expiration date of a cookie alone taking into account no other factors, or the fact that a cookie persists for a whole browser session, alone and taking into account no other factors is a sign of any vulnerability. 

I don't know the internal implementation but I don't think you have much to worry about here.

If you are still concerned you can try to make a support ticket here:

Create a new Power Platform Support Ticket

However, I am not sure what you would put there because I didn't see any problem here in what you described.

[michaelgappa1]

Thank you, that makes sense. As long as it's configured under site settings, the server will do the rest regardless of the cookie value.