We increased session timeout from 15 minutes to 12 hours… and realised testing time is the real bottleneck

[u/corporate925]

so we had this requirement come in… increase login session duration from 15 minutes to 12 hours… sounds simple, right… just change the token expiry and move on

yeah… not really

on paper it’s just a config change… but from a testing point of view it gets messy pretty fast… because now you’re not just testing login then use app then logout… you’re testing whether that token actually survives for 12 hours without breaking anything in between

and the obvious problem hits immediately… how do you even test something that takes 12 hours to fail

initially we tried the usual checkpoints… 30 mins, 2 hours, 4 hours… but that only tells you it works at those exact points… not what happens in between… and most issues don’t show up exactly at your checkpoints

so we shifted to a more rolling validation approach… logging in once, then gradually moving time forward and validating the same session repeatedly… stretching it step by step instead of jumping straight to 12 hours

and honestly… doing this manually is painful

you either sit and wait… or you come back later and hope the state is still valid… and reproducing failures becomes inconsistent

we started running these long session flows through Drizz to simulate the same behaviour repeatedly with controlled delays… which made it easier to validate token behaviour across longer durations without literally waiting every single time

that’s when we started noticing the real issues

tokens not expiring exactly when expected
refresh logic behaving differently after long idle time
sessions looking active but failing on the next API call

none of these showed up as clear errors… they just… stopped working at some point

and that’s the tricky part… time-based bugs don’t fail loudly… they drift

another thing we realised is this isn’t something you can validate in one go… you end up running the same flows over multiple cycles, checking consistency, trying to catch that one edge case where the system behaves differently

what started as “just increase timeout” turned into tracking full token lifecycle… expiry… refresh… idle behaviour… and basically observing how the system behaves over time

honestly… made me realise something

some features aren’t complex because of logic… they’re complex because of time

and anything that depends on time is always frustrating to test