GO LANG GORILLA SESSION

 The gorilla/sessions package in Go handles session management, and when configured to use CookieStore, it sets a cookie in the browser to maintain session state. This process involves the following steps:

Gorilla session also creates session file in OS temp directory 

https://stackoverflow.com/questions/73263370/gorilla-session-not-setting-cookie

• Initialization of CookieStore:

  You initialize a CookieStore by providing a secret key. This key is crucial for authenticating and encrypting session data stored in the cookie, ensuring its integrity and preventing tampering.
• Session Retrieval/Creation:

  In your HTTP handler, you call store.Get(r, "session-name") to either retrieve an existing session associated with the incoming request or create a new one if no session with that name is found.
• Data Storage:

  You can then store data within the session.Values map, which is a map[interface{}]interface{}. This map holds the key-value pairs representing your session data.
• Saving the Session:

  Crucially, you call session.Save(r, w) (or store.Save(r, w, session)) before writing any other content to the http.ResponseWriter. This method serializes the session data (including the session.Values), encrypts it using the secret key, and then sets the Set-Cookie HTTP header in the response.
• Browser Action:

  When the browser receives the Set-Cookie header in the HTTP response, it stores the cookie containing the session ID and the encrypted session data.
• Subsequent Requests:

  On subsequent requests to the same domain, the browser automatically includes this cookie in the Cookie HTTP header of the request, allowing gorilla/sessions on the server to retrieve and decrypt the session data, thus maintaining the user's state across requests.

Important Note: The MaxAge option, either set globally for the CookieStore or individually for a session's Options, determines how long the browser should retain the cookie. This MaxAge value is included in the Set-Cookie header sent to the browser.

Session & Cookie in Server & each of their expiry

 https://security.stackexchange.com/questions/87269/how-is-the-session-id-sent-securely

Server creates session, creates session file with session ID, store needed information in session file,token etc, then instruct brower to set cookie to store the session ID.

Then during https communication, browser addes session ID into header for server to fetch :

 headers as Cookie:[Token]; [Other cookies];. T

Cookie and session file has different expiry time

Cookie expiry is set by server :

https://stackoverflow.com/questions/13154552/how-can-i-set-a-cookie-with-expire-time

  document.cookie = 'cookie=ok;expires='+now.toUTCString()+';path=/';
  //console.log(document.cookie);  // 'Wed, 31 Oct 2012 08:50:17 UTC'

Server session file removal (session ID expiry) is done through server config, it is differnt via different programming language

For PHP

https://stackoverflow.com/questions/2327681/how-does-a-server-judge-a-session-to-be-expired-and-how-can-the-expiry-time-be-c

First of all, don't confuse cookie settings (which are client-side) and garbage collection (which is server-side). Cookie settings only affect the expiration of the session_id. Session data may still exist on the server even if the browser has removed the cookie and, on the contrary, the server can remove the data while the session_id is still remembered by the browser.
The cookie can be set to expire when you close the browser or in a specific date and time (I believe the default option is the first one, but I'd have to check it). In both cases, if the user interacts with the site the cookie will remain valid since it's renewed on each response.
Session data is removed when the garbage collection is launched but you must take into account that:
The garbage collection is started randomly, triggered by a page request.
It removes session data not modified in more that gc_maxlifetime seconds.
By default, session data is stored in files and PHP doesn't track what site owns what files. That means that storing sessions in the default shared location makes you lose control on session expiration: the site that's configured to keep session data for the shortest time is likely to remove data from other sites with longer time.
To sum up, if you want full control on your data lifetime you need to store session data in a private directory, e.g.:
session_save_path('/home/foo/sessions');
ini_set('session.gc_maxlifetime', 3*60*60); // 3 hours
ini_set('session.use_only_cookies', TRUE);
session_start();