Validating the security stamp is extending the session if allowRefresh is false

Is there an existing issue for this?

• I have searched the existing issues

Describe the bug

In the below resolved issue, you fixed the code so that it does NOT extend the session if slidingExpiration is false. https://github.com/dotnet/aspnetcore/issues/36373

Should you not also NOT extend the session if allowRefresh is false?

I don't understand the purpose of allowRefresh really.

Expected Behavior

When the security stamp check is done, the session is not extended if allowRefresh is false, or SlidingExpiraton is false.

Steps To Reproduce

builder.Services.ConfigureApplicationCookie(options =>
{
    // Cookie settings
    options.Cookie.HttpOnly = true;
    options.ExpireTimeSpan = TimeSpan.FromMinutes(10);
    options.SlidingExpiration = true;
    options.Events.OnSigningIn = (context) => {; context.Properties.IsPersistent = true; context.Properties.AllowRefresh = false; return Task.CompletedTask; };

    
});


builder.Services.Configure<SecurityStampValidatorOptions>(options =>
{
// Revalidate every 5 minutes instead of 30
options.ValidationInterval = TimeSpan.FromMinutes(1);
    options.OnRefreshingPrincipal = async (a) => { Console.WriteLine("SEC STAMP CHECK"); };
});

Observe that when the security stamp check occurs, the session is extended.

Exceptions (if any)

No response

.NET Version

No response

Anything else?

No response