But aren't those two different options - that might need to different lengths?
- The cookieTimeout is the absolute value that cannot ever be changed once created.
- The sessionTimeout usually is way shorter and the dynamic value that is updated each time you use the session.
So both are needed IMO