title: What is the default session expiry in .NET Core 2.x?
body: <p>In my startup class, I am enabling session storage with this line:</p>
  
  <pre><code>        services.AddDistributedMemoryCache()
          .AddSession(options =&gt;
              {
                  options.IdleTimeout = TimeSpan.FromMinutes(20);
                  options.Cookie.HttpOnly = true;
              })
  </code></pre>
  
  <p>However, if I understand this correctly, setting the <code>IdleTimeout</code> property simply states that the session will begin anew if the user does not complete any actions for > 20 minutes. My app has polling which uses user information in the session storage every 5-10 seconds, so I don't think this would ever be of use here. User permissions and roles can change from actions made outside of the current user's browser, so I would like to limit the session storage to 1 minute. I can't seem to find any exact verbiage on what the default expiration is or how to properly set that. </p>
  
  <p>The CookieBuilder class has Expiration and MaxAge options, but I don't know which one is necessary. I've also read that <a href="https://github.com/aspnet/AspNetCore/issues/4671" rel="noreferrer">Expiration is ignored</a>, so that adds even more to my confusion in this subject.</p>
  
  <p>Update: I receive this message when I try to set the expiration: "Expiration cannot be set for the cookie defined by SessionOption", so I've set MaxAge to 1 minute, yet I can see that the session still has old user data in it after more than 1 minute has passed.</p>