Should I set a shorter Max-Age parameter on the cookies?

Max-Age 或 Expires cookie 参数只控制浏览器是否将值发送到服务器。由于刷新令牌代表用户在该浏览器上的长期认证会话，因此在 cookie 上设置较短的 Max-Age 或 Expires 参数只会导致用户体验下降。

🌐 The Max-Age or Expires cookie parameters only control whether the browser sends the value to the server. Since a refresh token represents the long-lived authentication session of the user on that browser, setting a short Max-Age or Expires parameter on the cookies only results in a degraded user experience.

确保用户已经注销或会话已结束的唯一方法是使用 getUser() 获取用户的详细信息。getClaims() 方法只会检查本地 JWT 的有效性（签名和过期时间），但它不会向认证服务器验证会话是否仍然有效，也不会确认用户是否已经在服务器端注销。

🌐 The only way to ensure that a user has logged out or their session has ended is to get the user's details with getUser(). The getClaims() method only checks local JWT validation (signature and expiration), but it doesn't verify with the auth server whether the session is still valid or if the user has logged out server-side.