Section 3.1.1. in RFC 6665 is the correct reference here. But it does point to RFC 3261.
"200-class responses to SUBSCRIBE requests also MUST contain an
"Expires" header field. The period of time in the response MAY be
shorter but MUST NOT be longer than specified in the request."

—
Reply to this email directly or view it on GitHub.