Implicit refresh with cookies: timeout does not remove JWT/CSRF cookies – was this expected?

[cpolish]

Implicit refresh with cookies: timeout does not remove JWT/CSRF cookies – was this expected?

[vimalloc]

I don't think this behavior was really intentional one way or the other, it's just how it ended up after all the different iterations of this extension!

I think for now handling this manually with ether a custom decorator or using the max-age argument when initially setting the cookie would be the best approach. I'm not opposed to having it done automatically in the default callback, but I worry that this could introduce subtle breaking changes in the off chance that people are inspecting cookies in their frontend for any reason, or if someone is using both access and refresh jwts stored in cookies, and trying to decide which ones should be removed.

I hope this helps! Let me know if you have any follow up thoughts on the matter! 😊