Auth is a product, not a feature.

“Just generate a token and check it later, right?” You build your app, add a login form, generate a JWT, and call it a day. A couple of days later, a user complains they keep getting logged out. Then you start wondering: should the token be long-live...