mirror of
https://github.com/nais/wonderwall.git
synced 2026-08-19 19:16:14 +00:00
Refreshes are activity-based and synchronous-on-expiry, so the proactive leeway only hides refresh latency and provides retry headroom; it is not what prevents serving expired tokens. Shrink it from 5m to 30s to align with identity provider guidance against refreshing long before expiry, while keeping decent end-user UX.