Which policy practice directly reduces the risk of credential theft through cookies?

Which policy practice directly reduces the risk of credential theft through cookies?

• A. Never deleting cookies
• B. Automatically delete cookies upon browser termination
• C. Sharing cookies across devices
• D. Storing cookies on server side only

Answer: (B)

Cookies hold session data such as authentication tokens. If that cookie sticks around after you close the browser, someone with access to the device can reuse it to impersonate you and access accounts. Automatically deleting cookies when the browser terminates makes those tokens live only for the current session, so there’s no lingering credential to steal when the device is later used by someone else. This directly cuts the window of opportunity for cookie-based credential theft, especially on shared or public machines. For stronger protection, pair this with HttpOnly, Secure, and SameSite settings to reduce exposure even further.

Cookies hold session data such as authentication tokens. If that cookie sticks around after you close the browser, someone with access to the device can reuse it to impersonate you and access accounts. Automatically deleting cookies when the browser terminates makes those tokens live only for the current session, so there’s no lingering credential to steal when the device is later used by someone else. This directly cuts the window of opportunity for cookie-based credential theft, especially on shared or public machines. For stronger protection, pair this with HttpOnly, Secure, and SameSite settings to reduce exposure even further.