ASP.NET Core's cookie middleware can be configured like so:
builder.Services.ConfigureApplicationCookie(x => {
x.SlidingExpiration = true; // the default
x.ExpireTimeSpan = ...
x.Cookie.MaxAge = ...
});
ExpireTimeSpansets the lifespan of the actual authentication "ticket" enclosed in the cookie; after that time, the middleware will reject that auth ticketCookie.MaxAgesets the lifespan of the cookie itself; after that time the browser should delete the cookie
A scenario: one could configure it such that if the user logs in weekly, the auth ticket would be kept alive for a year (due to sliding expiration); at that point, the cookie itself would reach it's max age and would be deleted by the browser.
Is that the intended use case? Are there other use cases where their values should differ?