Feature #16678

Updated by Peter Amstutz over 1 year ago

Add a feature where tokens issued through web login have a default lifetime. An
expiration time of 8 or 12 hours implements a policy where users are required to log in again each day, and limits the amount of time an attacker could make use of a stolen token. The token is prevented from manipulating other tokens (i.e. getting other tokens or creating a new token without an expiration).