That correct. You would use the timer to auto-refresh the token. Note: if you close the tab, if you use a session cookie for token storage, its likely to remai

That correct. You would use the timer to auto-refresh the token. Note: if you close the tab, if you use a session cookie for token storage, its likely to remain, but like you said will become invalid within 5 minutes. If you close the browser however, a Session cookie will be deleted, which mitigates an issue in a shared setting. Depending on the requirements, you can ask a user whether they are using a shared pc or a private pc and choose cookie storage at that point.