This rule is deprecated, and will eventually be removed.

## Why is this an issue?

Cookies without fixed lifetimes or expiration dates are known as non-persistent, or "session" cookies, meaning they last only as long as the browser session, and poof away when the browser closes. Cookies with expiration dates, "persistent" cookies, are stored/persisted until those dates.

Non-persistent cookies should be used for the management of logged-in sessions on web sites. To make a cookie non-persistent, simply omit the `expires` attribute.

This rule raises an issue when `expires` is set for a session cookie, either programmatically or via configuration, such as `session.cookie_lifetime`.

## Resources

- OWASP - Top 10 2017 Category A7 - Cross-Site Scripting (XSS)
- OWASP, Session Management Cheat Sheet - Expire and Max-Age Attributes
- Derived from FindSecBugs rule COOKIE_PERSISTENT