Token refresh that protects sessions without trapping users
Aggressive expiry looks secure until legitimate refresh storms lock people out during peak commute hours.
Short-lived access tokens help when theft windows matter. They hurt when every background sync races a refresh endpoint that rate-limits hard.
Design refresh with single-use rotation, clear revocation lists, and client backoff that does not serialize the entire app behind one mutex. Multi-device users need predictable device lists, not mystery logouts.
Measure auth failures as product symptoms: refresh 401 spikes after releases, silent re-login loops, and push tokens orphaned after session kill. Those signals belong in the same review as API latency.
Hardening guidance should separate fraud controls from UX traps. A workforce app and a consumer marketplace rarely share the same session lifetime for good reason.