Sessions expire differently on different places on the web:
- StackOverflow: never expires
- Twitter: never expires
- Facebook: never expires
- Stripe: expires after like 30 min or an hour or so
- Some bank websites: expire after 15 minutes of inactivity
- Other websites expire after 5 minutes no matter what
Latest practices say to keep requests session-less and to use a JWT that auto-refreshes every 15 minutes or on a new request, using a refresh token. The reason for this is you can blacklist a token quickly if it gets in the wrong hands, and it won't be usable for more than 15 minutes, keeping the attack duration minimal.
The problem is that you don't want to logout a user every 15 minutes, it's a bad UX. StackOverflow and Twitter are great because you're always logged in.
The confusing part is why StackOverflow/Twitter don't do this. It seems like a security risk if you follow along the session-less 15-minute expiration path, or perhaps they are doing something to mitigate the risk.