title: ASP.NET Core 3.1 / Identity session never expires. How can I get it to expire on sliding expiration?
body: <p>A security check of my website showed that sessions (i.e. login) never expire. I've tested myself and I find the same - I opened up the site on localhost this morning and I'm still signed in from yesterday. I always assumed it would expire after 20 minutes like it would in .NET Framework apps.</p>
  <p>I'm using the ASP.NET Core Identity scaffolding with minimal changes other than implementing two factor authentication.</p>
  <p><a href="https://i.stack.imgur.com/AmlqY.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/AmlqY.png" alt="enter image description here" /></a></p>
  <p>In my Startup.cs I have the following code to add session support:</p>
  <pre><code>services.AddSession(options =&gt;
  {
      options.Cookie.IsEssential = true;
      options.IdleTimeout = TimeSpan.FromSeconds(10);
      options.Cookie.Expiration = TimeSpan.FromSeconds(10);
  });
  </code></pre>
  <p>I can't see any code relating to login timout under IdentityOptions.</p>
  <p>On the login page, I'm specifically hardcoding any &quot;remember me&quot; type function to false:</p>
  <p><code>await _signInManager.SignInWithClaimsAsync(user, isPersistent: false, claims);</code></p>
  <p>How can I make my login sessions expire after ~20 minutes like they do automatically in .NET Framework?</p>
  <p>I basically have the exact opposite problem to the one mentioned in this question:
  <a href="https://stackoverflow.com/questions/45825684/asp-net-core2-0-user-auto-logoff-after-20-30-min">asp.net-core2.0 user auto logoff after 20-30 min</a></p>
  <p>Most questions on here seems to be asking how to increase  the timeout, but I need it decreased from (seemingly) infinite to 20 minutes or so:</p>