Session authentication tokens are effectively a form of credential. Best practice is to expire all credentials after a certain amount of time, because you canno

Session authentication tokens are effectively a form of credential. Best practice is to expire all credentials after a certain amount of time, because you cannot know for sure all the ways this credential might be compromised or when. It does mitigate risk to reduce the time window in which an attack is feasible / when the attacker might get the credential, and when they might start their attack. Just because you assume that every attacker has access to X, or has root on their machine, or is everywhere always, etc, doesn't make it true. Some attackers don't have a big advantage; mitigating their attacks helps security. In addition, the kind of credential tends to dictate the expiration time. Some don't need to be expired that often. You can also mitigate a lot of the risk by requiring re-authentication to perform riskier actions, like changing email address, or authorizing payment. Combine with other methods like user fingerprinting to force re-authentication if it looks like it might be a different user. If you're thinking "but we don't rotate passwords as best practice anymore, why sessions?" We basically gave up on passwords. It would help security if people rotated passwords, but unfortunately it's such a pain for the users that they end up doing insecure things like writing them down or incrementing a number at the end, so a compromised password tells you what the next likely one is. If they were randomly generated we would absolutely be rotating passwords still.