为什么关闭浏览器窗口后非持久性cookie没有过期？

Question

From web I've learned that there are two types of cookies: Persistent Cookies and Non-Persistent Cookies. Non-Persistent Cookies are created if I don't specify the expiration time. I also learned that Non-Persistent Cookies are removed once the browser is closed, but in my case even though I closed the browser window, I can still navigate into my application without a successful login.

public ActionResult Index(Login userLogin)
{
    if (ModelState.IsValid)
    {
        Login Login = loginBusinessLayer.GetUserLogin(userLogin.UserId, userLogin.UserName);
        if (Login.UserPassword == userLogin.UserPassword)
        {
            Session["UserLogin"] = Login;
            User user = userBusinessLayer.GetUser(Login.UserId);
            Role role = roleBusinessLayer.Roles.Single(rle => rle.RoleId == user.RoleId);
            Session["Role"] = role;

            HttpCookie cookie = new HttpCookie("UserLogin");
            cookie["LoginId"] = Convert.ToString(Login.UserId);
            cookie["RoleId"] = Convert.ToString(role.RoleId);
            Response.Cookies.Add(cookie);
            return RedirectToAction("Success", "Login");
        }
        else
        {
            return View();
        }
    }
    return View();
}

Answer 1

Modern browsers continue to run in the background, even though all visible Windows are closed. For example Google Chrome on Windows need to be closed from the small notification icon in the task bar to really get shut down. If that is done, the session cookies are removed.

And for the record, that login method of yours contain a number of security flaws. I hope it just is an example. Use the built in libraries in asp.net: Asp.NET Identity and the Owin providers.