Issue
As per OWASP sesssion's must have an absolute timeout which defines the maximum amount of time a session can be active. I know how to set the max inactivity timeout for a spring session using server.servlet.session.timeout however I am not sure how to set the absolute timeout for the session. I guess I could set the Max-Age attribute for the Cookie which would potentially serve as an absolute timeout, however I was wondering if the absolute timeout could be somehow set on the server side session?
Solution
This feature is not implemented in Spring sessions. See https://github.com/spring-projects/spring-session/issues/922 for workaround.
Answered By - manofaction
Answer Checked By - Katrina (JavaFixing Volunteer)
