Why does Chrome's "EditThisCookie" extension, seem to list some cookies as 'session' with an expiry date?

Question

An answer here View / See / Read cookies in Google Chrome suggested this extension. (I have since found it's not a good extension and very problematic, as i've commented there, but anyhow)

Why does Chrome's "EditThisCookie" extension, seem to list some cookies as 'session' with an expiry date?

I've read that session cookies don't have an expiration date,

https://security.stackexchange.com/questions/33692/what-typically-is-the-expiration-date-of-a-session-cookie

" If there is no expiry set on the cookie, then it is a session cookie and will live as long as the browser is open"

And https://en.wikipedia.org/wiki/HTTP_cookie#Session_cookie "session cookies do not have an expiration date assigned to them, which is how the browser knows to treat them as session cookies."

But info provided by EditThisCookie seems to contradict that.

I installed the Chrome extension, EditThisCookie I notice that when I go to this website (a website that displays nothing, it's a very plain website, but it sets two cookies).

https://infinite-shelf-13133.herokuapp.com/

And I view the cookies

This cookie too from that website, shows as session and with an expiry date

With most websites, cookies that have an expiration date, don't show as session cookies in EditThisCookie, e.g. see this cookie from google.com

What might it be about the two cookies on https://infinite-shelf-13133.herokuapp.com/ to show in EditThisCookie as session cookies. Whereas even with other websites cookies don't.

I made that website with rails and a line cookie[:abc]="zzz" and uploaded it to heroku. Just to understand cookies a bit better. And I ran into that question.

Answer 1

Firstly, even though the extension "EditThisCookie" has been mentioned by some on this website, I have since seen that others here and elsewhere have pointed out that it's adware https://malwaretips.com/blogs/remove-editthiscookie-chrome-extension/ (though the author commented on a thread on superuser/stackoverflow that it's opt-in adware, though also, the author's site is full of suspicious adverts and false download links). You can view cookies fine in Chrome chrome://settings/siteData (Chrome 73) or chrome://settings/content/cookies then clicking "see all cookies and site data", which takes you to chrome://settings/siteData. So you can bookmark that chrome link. If you want to edit Cookies, you can use this Chrome extension instead Cookie Editor

Secondly,

It looks like EditThisCookie gives incorrect information

Information presented from those two reliable information websites, state that a session cookie i.e. a cookie that expires at the end of a browsing session, has no expiry date. Also https://stackoverflow.com/questions/4132095/when-does-a-cookie-with-expiration-time-at-end-of-session-expire this is from a question about php and when using php's setcookie, but no doubt it's true of cookies generally. "...you can either set the expiration time to 0 or simply omit the parameter - the cookie will then expire at the end of session (ie, when you close the browser)."

So, session cookies don't expire after a year. And cookies that expire after a year aren't session cookies.

Notice how Google Chrome describes those cookies. It describes them as expiring at the end of a session. Nothing about them expiring after a year.

I think we can assume Chrome is right, as it's also consistent with those other information websites. And that extension (which is also adware), is wrong.

As to what is going on, it looks like if there's no expiration date, it marks it as session (which is right), and it (wrongly) sticks a date on there of one year from the current date. So on april 26th 2019 it said the expiry was april 26th 2020. If there's no expiration date it shouldn't put one on there. Anyhow, one shouldn't use the extension.. it has some kind of opt-in malware.. There is chrome://settings/siteData for viewing cookies in chrome, and an extension called 'cookie editor' for editing them.