A cached POST response that outlives its meaning is a security bug, not a stale page. A
verification says "this token was valid a moment ago"; served an hour later it says nothing, and
serving it anyway is a replay window. Two minutes matches the lifetime of the tokens this is
built for and is short enough that a leaked cache entry is not worth harvesting.
How long a result stays usable.
A cached POST response that outlives its meaning is a security bug, not a stale page. A verification says "this token was valid a moment ago"; served an hour later it says nothing, and serving it anyway is a replay window. Two minutes matches the lifetime of the tokens this is built for and is short enough that a leaked cache entry is not worth harvesting.