What are remembered browsers or persistent sessions?¶
A remembered browser or persistent session allows a user to return to a cloud service without completing a full login each time.
The browser stores a cookie or token that the service accepts as evidence of an existing session.
What this means in practice¶
A persistent session may survive closing the browser, restarting the computer or changing network. Depending on the service, it may continue for days, weeks or longer.
This can explain activity that appears without a nearby login event. It can also allow another person using the same browser profile to enter the account.
A remembered browser is not the same as a trusted physical device. The session may be tied to one browser profile, while another browser on the same computer requires a new login.
In an organisational environment, browser profiles may roam between devices or be managed centrally. A session may also be restored from synchronised browser data.
If the account is compromised, ending remembered sessions may require explicit revocation rather than simply closing the browser or changing the password.
What this may show¶
Provider logs may record session creation, later use, refresh, expiry and revocation. Device evidence may show cookies, browser profiles, cached pages, account identifiers and local history.
What this does not show on its own¶
The dangerous assumption is that opening the account always means the user has just entered the password.
But the presence of a session does not prove who used it. The computer may be shared, remotely accessed or compromised.
When investigating access, look for the original authentication event and the later activity linked to the same session. Do not expect a new login record for every use.
Key takeaway
A remembered browser can provide continuing access without a fresh login, so link later activity to the original session and identify who could use that browser profile.