We are currently using JSON web tokens for authentication for our website's API. We use 1 hour short-lived access tokens that get refreshed using a permanent revocable refresh token.
Now we want to add an account + login system to the website and tie it to the API usage. However, we are currently debating on the security of this.
The naive implementation would be just a 3 hour access token for a session and something like 2 weeks expire time if the user chooses the "stay logged in" option. However, this would kinda make the short expire time useless. In case the tokens get leaked you have an attack window of two entire weeks.
The alternative we thought of would be some kind of "proxy" that checks if the token is expired and refreshes automatically with the refresh token in localstorage or as a cookie.
Would the naive version be an acceptable implementation or are the security risks too high?