What does the 'Max-Age' cookie attribute specify, and how does it differ from 'Expires'?

• A.Max-Age specifies the number of seconds until the cookie expires (relative to when the cookie is set). Expires specifies an absolute date/time. Max-Age takes precedence when both are present. Max-Age is preferred because it avoids clock synchronization issues - the browser's local clock may differ from the server's, causing Expires to behave unpredictably
• B.Max-Age is for session cookies; Expires is for persistent cookies; setting Max-Age=0 marks the cookie as a session cookie rather than deleting it, which is why logout also clears storage; the Expires attribute is evaluated against the server's clock at validation time, and client clock drift has no effect; the 4096-byte cookie limit applies to the whole cookie jar across all sites, not to each individual cookie
• C.Expires is relative to the server clock; Max-Age is relative to the user's midnight; a Max-Age in the past causes browsers to quarantine the cookie for auditing rather than removing it immediately; the __Host- prefix requires a Domain attribute, pinning the cookie to the registrable domain and all subdomains; sliding expiration is a server fiction, as a cookie's Expires value cannot be extended once it has been set; the Secure attribute is what prevents JavaScript from reading a cookie, while HttpOnly restricts it to TLS connections