I have a Play 2.3.7 application which I have configured the session.maxAge value. Authentication is done via a token in the session. If I log in, allow the maxAge duration to pass, and attempt to call an endpoint, I get a 401 as expected. However, if I copy the cookie from the browser while it is still valid, let it expire, and then manually add the cookie back to the browser's cookies, it appears that the cookie works again.
My questions are:
- Are the cookie expirations only enforced on the browser?
- If so, is it left to the developer to permanently expire cookies if desired?