I've not used the CGI::Cookie module, but I can tell you in general that you should never rely on the client to expire a cookie correctly. The cookie record in the database should have an expiration field, and your code that checks the cookie should refuse to accept expired ones.