> 1: A short compromised session is still a compromised session. But an expired compromised session is not a compromised session. If a session cookie/ID is co

> 1: A short compromised session is still a compromised session. But an expired compromised session is not a compromised session. If a session cookie/ID is compromised after it has expired it is no use to anyone. But if a session cookie/ID has no expiry built in, then it remains an open compromise risk forever. Situations where we can expect the session identifier and the context in which it is stored to reasonably be under the control of the user for a short time - while they are actively using a site, say - but where it might not remain under their control after they've finished using it, are a real part of real threat models. If I have some cross-site-request-forgery phishing scam that works on users who are logged in to a bank website, that requires them to have an active session at the time they open their email, or visit my site, or whatever... if their banking sessions time out after 15 minutes of inactivity, they are less vulnerable to that threat than if their browsers keep them logged in all the time.