|Did you know ...
0 (zero) disables timeout.
/. Cookies are only sent if the HTTP request path
is a refinement of Path.
(default), which creates a session if there is a request
whose path matches the defined session path or
in which cases sessions are only created by calling
active, which starts a thread that
performs session cleanup at close to the moment of the
passive, which runs session GC when a new
session is created.
lax (default), or
strict - The
SameSite attribute prevents the CSRF vulnerability.
strict has best security, but prevents links from
external sites from operating properly. lax stops most
CSRF attacks against REST endpoints but rarely interferes
with legitimage operations.
none removes the samesite
attribute entirely. Caution: The value
none exposes the
entire site to CSRF attacks.