Cookies are destroyed at the point the user closes the browser and unless a deletion date has been set. If the user closes the browser without sign out then default deletion date has been set, the cookie will be destroyed on that deletion date instead
Insecure Configuration Management