Ceiling on the token lifetime, in seconds (24 hours).
A policy bound rather than a mechanical one. The token exists to outlive a
login form sitting open; past a day it stops being that and becomes a
long-lived bearer value sitting in a JS-readable cookie. reference.conf
and the session.csrf.ttlSeconds schema restate this number — the schema
cannot import it, since session depends on core and not the reverse, so
a test in this package pins the two together.
Ceiling on the token lifetime, in seconds (24 hours).
A policy bound rather than a mechanical one. The token exists to outlive a login form sitting open; past a day it stops being that and becomes a long-lived bearer value sitting in a JS-readable cookie.
reference.confand thesession.csrf.ttlSecondsschema restate this number — the schema cannot import it, sincesessiondepends oncoreand not the reverse, so a test in this package pins the two together.