It's unlikely that Google or Facebook keeps users' sessions active indefinitely. They typically reset the expiration time and extend it as users continue to visit their websites.
Sessions are controlled using Session Cookies, which contain a unique ID for each session and are stored in the user's browser.
Try this little experiment: go to facebook.com, log in to your account, and then enter the following code in the URL Bar and hit enter:
javascript:alert(document.cookie);
Make sure to include the leading javascript: part, as some browsers may omit it when copying and pasting.
You'll see a popup box displaying Facebook's session cookie, which is called presence
.
Next, run the following code and then refresh the Facebook page:
javascript:window.execScript("document.cookie=''");
Facebook will prompt you to log in again because you've cleared your Facebook cookie and it no longer recognizes your session.
Unlike some server-side scripting technologies like ASP.NET, most do not keep their session cookies persistent, only storing essential information like login details. If you want to store additional user data, you'll need to create your own cookie and check it in your Login.aspx.cs file.
When saving user information in cookies, consider including the user ID, User Agent, and encrypting the cookie. Including the User Agent or a unique identifier can help prevent Man-In-The-Middle attacks. Some websites even store the IP address in cookies for added security.
For more information on persistent cookies, you can refer to MSDN.