No, SlidingExpiration is not the answer

So the question is, shall we use slidingExpiration and what is the point of using it? I never had a good feeling with the slidingExpiration, basically i don’t like slidingExpiration for two big reasons. The slidingExpiration setting was born as an application measure to reduce the risk of token stealing. when set to false, the specified timeout interval becomes a fixed period of time from the initial login, rather than a period of inactivity. Attackers using a stolen  authentication token have, at maximum, only the specified length of time to impersonate the user before the session times out. Because typical attackers of these Web-based applications have only the token, and don’t really know the user’s credentials, they can’t log back in as the legitimate user, so the stolen authentication token is now useless and the application security threat is mitigated. When sliding expiration is enabled, as long as an attacker makes at least one request to the system ev...