The refresh cookie had no Max-Age, so browsers dropped it on close while the Session stayed valid for 7 days. Set maxAge from REFRESH_TTL_MS, the same constant behind Session.expiresAt.
The refresh cookie had no Max-Age, so browsers dropped it on close while the Session stayed valid for 7 days. Set maxAge from REFRESH_TTL_MS, the same constant behind Session.expiresAt.