I would like to implement the familiar "Remember me" functionality on user login forms, i.e. if a registered user leaves the browser without hitting the log out link, (s)he will still be logged in when visiting the website afterwards. A quick search leads to the Remember me module, whose description states:
(...) the default Drupal behaviour is to remember your session for the extent of 3 weeks and 2 days. (...) Can you imagine the colossal risk this places on users accessing your service from public terminals or shared workstations, with no means to their disposal of securing themselves against this threat.
If the first sentence is true, it seems that I do not need the module to accomplish my need. Indeed, I can safely exit Firefox without loosing my session for "a while" (I do not know the exact time interval). However, other users on my website complain that they are immediately logged out after closing their browser.
So now I want to know the ins and the outs of the matter. Are sessions handeled differently for different browsers and, if yes, why? Does Drupal remember sessions for the extent of 3 weeks and 2 days and, if yes, why was this long time interval chosen? Is not using a module like Remember me indeed a risk?