No, the client would need to renew the cookie every 2.5 mins (similar approach to DHCP leases). If the external IP has changed, the cookie should not be renewed. If it's expired already, it should not be renewed.
This wont work, though, as nobody wants to sign in once per day. That's too inconvenient.
If you are using SSO (to enforce U2F) and password managers (really, basic levels of enterprise auth competence in 2021) then signing in multiple times per day isn't a huge hassle because it's just a click and a tap.
For customers, yes, but I've worked at places where we required employees to re-auth daily (if not more frequently).
I worked at a place where re-auth was required every twelve hours, which was a convenient reminder of when you'd been working way too long.
No, Slack would reauthenticate every 5 minutes. It doesn't mean that the user needs to do anything.
If you closed Slack for more than 5 mins, you’d get signed out. Users would hate it, which is why nobody does this.
So, the alternative should be "don't trust anything in slack because someone can just get your cookie and log in as you"?
Maybe there is a middle ground?
The middle ground is the SSO reauth interval, where companies can decide that for greater security they’ll made you reauth every 8 hours, daily, weekly etc to balance it against user pain. Companies do this today already.
Who closes slack for more than 5 minutes though? My desktop slack is pretty much running 24/7.