A developer wants to prevent a session from being valid after the user has been inactive for 15 minutes. Can this be achieved using only the cookie's Max-Age attribute?

• A.Yes - Max-Age=900 creates a session that expires after exactly 15 minutes of inactivity
• B.No - idle timeout requires the JavaScript Date API on the client side to track inactivity
• C.Yes - modern browsers automatically convert Max-Age to an inactivity timer for session cookies
• D.No - Max-Age is a fixed countdown from when the cookie was set, not an inactivity timer. A cookie with Max-Age=900 expires 15 minutes after issuance regardless of activity. True idle timeout must be implemented server-side: record the last-activity timestamp per session and reject requests where the elapsed time exceeds the threshold, updating the timestamp on each valid request