We have 2 MVC applications as clients and an Identity Server 4.

We have setup cookie middleware and openIdconnect using owin.

Client 1 has a cookie lifetime of 40 minutes.

Client 2 has a cookie lifetime of 10 minutes (maybe it's more strict for security reasons)

We send max-age = session\_length in the autzorization endpoint but in some cases we want to send the user immediately for re-authentication (for security reasons).

So, we decided to send max-age=0 in these cases.

So our problem is if we need to send the user for re-authentication before client cookie is expired, the user will be redirected to Identity Server with max-age=0 but what happening if a user hits again the client login page, the user will be redirected with max-age=session\_length and the user will get tokens.

How can we protect the client?
The user is not authenticated so we don't know which user it is. How can we store information about the users previous activity? For example, where can we store the previous max-age value? So if the user tries to access the login page again we will know the correct max-age value.