title: When session should expire in Identity Server 4 with MVC client?
body: <p>I am using MVC client with IdentityServer3.AccessTokenValidation and Identity Server 4 as my IDP app.</p>
  
  <p>I have added cookie timeout at below places, however seems like session never expires and doesn't automatically logout the user - </p>
  
  <p>In MVC client -</p>
  
  <pre><code>app.UseCookieAuthentication(new CookieAuthenticationOptions
  {
      AuthenticationType = "Cookies",
      ExpireTimeSpan = new TimeSpan(0, 20, 0, 0)
  });
  </code></pre>
  
  <p>If I set time less than 20 hours, authorization request runs for infinite loop</p>
  
  <p>In IDP app, </p>
  
  <pre><code>services.AddIdentityServer(
      opt =&gt; new IdentityServer4.Configuration.IdentityServerOptions
      {
          Authentication = new IdentityServer4.Configuration.AuthenticationOptions()
          {
              CookieLifetime = TimeSpan.FromSeconds(60)
          }
      }
  </code></pre>
  
  <p>In IDP app,</p>
  
  <pre><code>.AddCookie("Cookies", opt =&gt; {
      opt.ExpireTimeSpan = TimeSpan.FromSeconds(60);
      opt.Cookie = new CookieBuilder() { Expiration = new TimeSpan(0,0,0,60) };
      opt.Events.OnSigningIn = (context) =&gt;
      {
          context.CookieOptions.Expires = DateTimeOffset.UtcNow.AddSeconds(60);
          return Task.CompletedTask;
      };
  }) 
  </code></pre>