Persistent cookies

By default, SharePoint uses persistent cookies. The use of persistent cookies offers the richest and smoothest user experience at the expense of security. When persistent cookies are used, all Microsoft applications, including Internet Explorer and Office products, share the same authentication cookie. The result is that the user has to sign in only once. For example, if the user authenticates to SharePoint, an Office application will use the same cookie for authentication. Correspondingly, if the user signs out from SharePoint in Internet Explorer, the ongoing Office session is also terminated, resulting a warning "Connection lost to server".

Use of persistent cookies must be carefully evaluated. For example, if a user opens an Office document from the SharePoint library directly using an Office application and authenticates himself, a persistent cookie will be created. Closing the Office application window will not remove the persistent cookie. Any document on the same SharePoint installation, to which the user has access rights, can be opened by any other Microsoft cookie sharing application (e.g. Internet Explorer and Office) without re-authentication.

Use of persistent cookies on shared desktop environments and for extranet users should be avoided.

Session cookies

Session cookies hinder the user experience but provide additional security. In the case of session cookies, the user has to authenticate separately to each application that uses SharePoint. If the application is closed, the session within the specific application is terminated. Some features, for example Windows Explorer integration, does not work with session cookies.

A more specific evaluation of SharePoint 2013 session and persistent cookies is provided in the following Microsoft document: Implementing Persistent Cookies in SharePoint 2013 Products at http://www.microsoft.com/en-au/download/details.aspx?id=30447

Restrictions

Check browser compatibility against Microsoft SharePoint release notes.