A developer wants to prevent a session from being valid after the user has been inactive for 15 minutes. Can this be achieved using only the cookie's Max-Age attribute?

• A.No - Max-Age is a fixed countdown from when the cookie was set, not an inactivity timer. A cookie with Max-Age=900 expires 15 minutes after issuance regardless of activity. True idle timeout must be implemented server-side: record the last-activity timestamp per session and reject requests where the elapsed time exceeds the threshold, updating the timestamp on each valid request
• B.Yes - browsers use Max-Age for idle timing and reset the countdown on each request that carries the cookie, and Max-Age=900 gives a 15-minute idle timeout; the server needs no activity timestamp of its own, and cookie attributes are the right place to enforce this control for the session. Server-side checks add nothing beyond what the browser already does for each request, a design that scales without any session store
• C.