diff --git a/Packages.props b/Packages.props
index 32d434b51..68ad28f6a 100644
--- a/Packages.props
+++ b/Packages.props
@@ -27,13 +27,13 @@
     <PackageReference Update="Microsoft.Owin.Host.HttpListener" Version="4.2.0" />
     <PackageReference Update="Microsoft.Owin.Hosting" Version="4.2.0" />
     <PackageReference Update="Microsoft.VisualStudio.Web.CodeGeneration.Design" Version="5.0.2" />
-    <PackageReference Update="OpenIddict.AspNetCore" Version="3.1.0" />
-    <PackageReference Update="OpenIddict.Abstractions" Version="3.1.0" />
-    <PackageReference Update="OpenIddict.EntityFrameworkCore" Version="3.1.0" />
-    <PackageReference Update="OpenIddict.Owin" Version="3.1.0" />
-    <PackageReference Update="OpenIddict.Quartz" Version="3.1.0" />
-    <PackageReference Update="OpenIddict.Validation.AspNetCore" Version="3.1.0" />
-    <PackageReference Update="OpenIddict.Validation.SystemNetHttp" Version="3.1.0" />
+    <PackageReference Update="OpenIddict.AspNetCore" Version="3.1.1" />
+    <PackageReference Update="OpenIddict.Abstractions" Version="3.1.1" />
+    <PackageReference Update="OpenIddict.EntityFrameworkCore" Version="3.1.1" />
+    <PackageReference Update="OpenIddict.Owin" Version="3.1.1" />
+    <PackageReference Update="OpenIddict.Quartz" Version="3.1.1" />
+    <PackageReference Update="OpenIddict.Validation.AspNetCore" Version="3.1.1" />
+    <PackageReference Update="OpenIddict.Validation.SystemNetHttp" Version="3.1.1" />
     <PackageReference Update="Quartz.Extensions.Hosting" Version="3.2.4" />
     <PackageReference Update="System.Net.Http.Json" Version="5.0.0" />
   </ItemGroup>
diff --git a/samples/Balosar/Balosar.Server/Controllers/AuthorizationController.cs b/samples/Balosar/Balosar.Server/Controllers/AuthorizationController.cs
index c5a412b18..d40e8e9be 100644
--- a/samples/Balosar/Balosar.Server/Controllers/AuthorizationController.cs
+++ b/samples/Balosar/Balosar.Server/Controllers/AuthorizationController.cs
@@ -75,7 +75,8 @@ public async Task<IActionResult> Authorize()
             // If a max_age parameter was provided, ensure that the cookie is not too old.
             // If the user principal can't be extracted or the cookie is too old, redirect the user to the login page.
             var result = await HttpContext.AuthenticateAsync(IdentityConstants.ApplicationScheme);
-            if (result == null || !result.Succeeded || HasCookieExpired(request, result))
+            if (result == null || !result.Succeeded || (request.MaxAge != null && result.Properties?.IssuedUtc != null &&
+                DateTimeOffset.UtcNow - result.Properties.IssuedUtc > TimeSpan.FromSeconds(request.MaxAge.Value)))
             {
                 // If the client application requested promptless authentication,
                 // return an error indicating that the user is not logged in.
@@ -336,12 +337,6 @@ public async Task<IActionResult> Exchange()
             throw new InvalidOperationException("The specified grant type is not supported.");
         }
 
-        private bool HasCookieExpired(OpenIddictRequest request, AuthenticateResult result)
-        {
-            return request.MaxAge != null && result.Properties?.IssuedUtc != null &&
-                DateTimeOffset.UtcNow - result.Properties.IssuedUtc > TimeSpan.FromSeconds(request.MaxAge.Value);
-        }
-
         private IEnumerable<string> GetDestinations(Claim claim, ClaimsPrincipal principal)
         {
             // Note: by default, claims are NOT automatically included in the access and identity tokens.
diff --git a/samples/Velusia/Velusia.Server/Controllers/AuthorizationController.cs b/samples/Velusia/Velusia.Server/Controllers/AuthorizationController.cs
index 13444fca1..5b256ab0c 100644
--- a/samples/Velusia/Velusia.Server/Controllers/AuthorizationController.cs
+++ b/samples/Velusia/Velusia.Server/Controllers/AuthorizationController.cs
@@ -81,7 +81,8 @@ public async Task<IActionResult> Authorize()
             // If a max_age parameter was provided, ensure that the cookie is not too old.
             // If the user principal can't be extracted or the cookie is too old, redirect the user to the login page.
             var result = await HttpContext.AuthenticateAsync(IdentityConstants.ApplicationScheme);
-            if (result == null || !result.Succeeded || HasCookieExpired(request, result))
+            if (result == null || !result.Succeeded || (request.MaxAge != null && result.Properties?.IssuedUtc != null &&
+                DateTimeOffset.UtcNow - result.Properties.IssuedUtc > TimeSpan.FromSeconds(request.MaxAge.Value)))
             {
                 // If the client application requested promptless authentication,
                 // return an error indicating that the user is not logged in.
@@ -341,12 +342,6 @@ public async Task<IActionResult> Exchange()
             throw new InvalidOperationException("The specified grant type is not supported.");
         }
 
-        private bool HasCookieExpired(OpenIddictRequest request, AuthenticateResult result)
-        {
-            return request.MaxAge != null && result.Properties?.IssuedUtc != null &&
-                DateTimeOffset.UtcNow - result.Properties.IssuedUtc > TimeSpan.FromSeconds(request.MaxAge.Value);
-        }
-
         private IEnumerable<string> GetDestinations(Claim claim, ClaimsPrincipal principal)
         {
             // Note: by default, claims are NOT automatically included in the access and identity tokens.