What a session token actually stands in for
After a principal authenticates, a session token lets it avoid resending primary credentials with every subsequent request. That convenience comes with a cost: for as long as the token is valid, possessing a copy of it is functionally equivalent to being the authenticated principal, whether or not the person who copied it went through authentication themselves.
A long-lived token maximizes convenience and maximizes the value of stealing it. A short-lived one, refreshed frequently through a separate and more tightly controlled mechanism, bounds how much a stolen token is actually worth to whoever took it.
Designing the tradeoff deliberately
There is no single correct token lifetime — the right choice depends on how sensitive the session's access is and how quickly a theft could realistically be noticed and contained. What matters is that the lifetime is a deliberate choice, tied to that answer, rather than whatever a framework happened to default to. A system handling highly sensitive actions with the same token lifetime as a low-stakes browsing session has made a choice, even if nobody remembers making it.