anti ae16c4437b feat(auth): make access-token TTL configurable, default 4h ...

Replace the hardcoded 1440-minute (24h) JWT lifetime with
DECNET_JWT_EXP_MINUTES (validated positive int, default 240 = 4h).
Shrinks the passive window of a stolen token; active revocation is
unchanged (immediate->=<10s).

2026-05-30 23:05:05 -04:00

1.6 KiB

Raw Blame History

View Raw