Gitea web session cookie only live for one browser session

[CrimsonEdgeHope]

Description

I notice I need to sign in to Gitea (via external identity provider) every time I open my browser then Gitea web, which can be quite annoying. I looked at our instance config session section:

[session]
#PROVIDER_CONFIG = /data/gitea/sessions
PROVIDER = db
COOKIE_SECURE = true
GC_INTERVAL_TIME = 3600
SESSION_LIFE_TIME = 86400

Nowhere wrong. Checked backend logs, simply router outputs. No error. Restarted Gitea, still same.
In console I see session cookie has no Max-Age. That means it would be deleted once I close browser, while CSRF cookie will be kept. Is this by design? Or Am I simply getting somewhere wrong? According to https://docs.gitea.com/next/administration/config-cheat-sheet?#session-session, to my understanding, SESSION_LIFE_TIME would set Max-Age of i_like_gitea

Gitea Version

e663c4a

Can you reproduce the bug on the Gitea demo site?

Yes

Log Gist

No response

Screenshots

Git Version

No response

Operating System

No response

How are you running Gitea?

Docker compose

Database

PostgreSQL

[MaxWaldorf]

I confirm that external Oauth2 provider never gave any satisfactory session keeping for our users as well...