Documentation / zerotal / auth / REMEMBER_MAX_AGE
Variable: REMEMBER_MAX_AGE
constREMEMBER_MAX_AGE:number
Defined in: packages/auth/src/RememberMe.ts:27
Cookie lifetime: 400 days.
400 days is the ceiling browsers enforce on Max-Age (Chrome 104+, followed by the
other engines), so a longer value is not a longer credential — it is the same credential
with a misleading number on it. The token is also rotated on every use, so the window an
intercepted cookie is valid for is the interval between the victim's own visits, not this.