Whenever a web method gets called using that connection string, then its expiration gets extended with 5 minutes. So it could stay valid for a very long time (if recycling in IIS is disabled).

If the connection string hasn't been used for 5 minutes, then it won't be valid anymore. But then you can just request a new connection string by authenticating again. This way it's not taking up server resources which aren't used for such a long time.

The 5 minutes interval is hardcoded and is not configurable.