Comment by croshan

Your logon cookies should be set serverside, with the Secure and HttpOnly flags set, entirely unaccessible by javascript. So they'll last 6 months.

When I see cookies set by javascript, their primary purpose seems to be user tracking, not auth.