No, they can be gone for any length of time. Think of the timestamp stored on the session cookie as a token -- as long as it matches the token on the server it

No, they can be gone for any length of time. Think of the timestamp stored on the session cookie as a token -- as long as it matches the token on the server it doesn't matter how long the token sits on the user's computer until their next request, it just has to match. The 30-second window is just to reduce false positives from an active user double clicking on a slow/flaky connection. Under the normal case of a matching token, the difference between (stored_session.timestamp - session.timestamp) will equal zero (no difference).