docs

internal/cognitoauth/auth.go

@@ -183,6 +183,9 @@ func setTokenCookies(c echo.Context, tokens *TokenResponse, accessTokenExpiresAt
 
 	// Set refresh token cookie (longer expiration - 30 days)
 	// Use UTC time and ensure proper expiration
+	// This must match the cognito side. So if you want to use a shorter
+	// (than the default 30 days) for this you should change it on the cognito client
+	// side as well as here.
 	refreshTokenExpires := time.Now().UTC().Add(30 * 24 * time.Hour)
 	refreshTokenCookie := &http.Cookie{
 		Name:     "refresh_token",