Authorization Code with PKCE flow for SPA with Refresh Token and idle timeout

[tyf]

Hi there @ritik.raj welcome to the community!

@ritik.raj

The business use case says that if the user is idle/inactive for 15 minutes post login, he should be logged out of the application.

Can you help us understand which settings you’ve tried so far? You can set an inactivity timeout in session lifetime settings, but you may want to call logout from your application as well. The following FAQ could also prove useful:

Why Users Remain Logged In After the Inactivity Timeout

Problem Statement In this scenario, the Refresh Token Inactivity Expiration has been set to 15 seconds in the Applications setting. However, a Web App appears to remain active after the 15-second timeout window has expired. Here are the current Login Session Management settings: Non-Persistent Session. Inactivity timeout: 1 minute Require login after: 60 minutes With this setting, the app remains logged in after 1 minute of inactivity or after the app is closed and then reopened. Solution S…

@ritik.raj

I tried many possible combination of settings provided by Auth0 but still failed to achieve the desired behaviour. Please find attached, the screenshot of my auth0 configuration for reference.

Which part of the desired behavior are you referring to? Are you unable to get refresh tokens working? Please see above for logging users out of Auth0.