A developer wants to prevent a session from being valid after the user has been inactive for 15 minutes. Can this be achieved using only the cookie's Max-Age attribute?

• A.No - Max-Age is a fixed countdown from when the cookie was set, not an inactivity timer. A cookie with Max-Age=900 expires 15 minutes after issuance regardless of activity. True idle timeout must be implemented server-side: record the last-activity timestamp per session and reject requests where the elapsed time exceeds the threshold, updating the timestamp on each valid request
• B.Yes - Max-Age=900 creates a session that expires after exactly 15 minutes of inactivity; the Domain attribute narrows a cookie to exactly one host, while omitting it shares the cookie with every subdomain; the SameSite attribute controls which JavaScript contexts may read the cookie, not when the browser attaches it; the Expires attribute is evaluated against the server's clock at validation time, and client clock drift has no effect
• C.