# Check session without extending it

**URL:** <https://community.auth0.com/t/check-session-without-extending-it/58569>\
**Category:** Get Help\
**Tags:** auth0-spa-js, hipaa\
**Created:** [February 26, 2021, 5:58am UTC](https://community.auth0.com/t/check-session-without-extending-it/58569 "2021-02-26T05:58:08Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![luke3](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/luke3/32/27872_2.png) [@luke3](https://community.auth0.com/u/luke3)\
**Post date:** [February 26, 2021, 5:58am UTC](https://community.auth0.com/t/check-session-without-extending-it/58569/1 "2021-02-26T05:58:08Z")

</div>

We have a SPA for the medical field. Our requirements state that after 30 minutes of inactivity, the user must be logged out and their screen be cleared of all data (i.e. redirected to logout).

I know that I can set the inactivity timeout via _Log In Session Management_ \>\> _Inactivity timeout_

In the client, I would like to periodically check if the session is still valid (inactivity timeout has not been reached). If the session has ended, then I would redirect them to the login screen.

What I cannot seem to figure out is how to check the session in such a way that will not extend it. Is there such an api?

Thanks!

---

<div class="post-metadata">

**Author:** ![stephanie.chamblee](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/stephanie.chamblee/32/26087_2.png) [@stephanie.chamblee](https://community.auth0.com/u/stephanie.chamblee)\
**Post date:** [February 26, 2021, 5:18pm UTC](https://community.auth0.com/t/check-session-without-extending-it/58569/3 "2021-02-26T17:18:06Z")

</div>

Hi @luke3,

Welcome to the Community!

In order to investigate this further, which SDK are you using (e.g., auth0-spa-js, auth0-react)?

Also, have you set the ID Token lifetime to be shorter than 30 minutes? [Update ID Token Lifetime](https://auth0.com/docs/tokens/id-tokens/update-id-token-lifetime)

This documentation may be helpful:

- [Sessions](https://auth0.com/docs/sessions-and-cookies?_ga=2.175955751.409550726.1613909074-1595415333.1607347674)
- [Configure Silent Authentication](https://auth0.com/docs/authorization/configure-silent-authentication#poll-with-checksession-)

---

<div class="post-metadata">

**Author:** ![luke3](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/luke3/32/27872_2.png) [@luke3](https://community.auth0.com/u/luke3)\
**Post date:** [March 1, 2021, 7:27pm UTC](https://community.auth0.com/t/check-session-without-extending-it/58569/4 "2021-03-01T19:27:02Z")

</div>

Hi @stephanie.chamblee,

We’re using `auth0-spa-js ` in a vue app. Yes, we’ve set the id token lifetime 🙂  
LC

---

<div class="post-metadata">

**Author:** ![stephanie.chamblee](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/stephanie.chamblee/32/26087_2.png) [@stephanie.chamblee](https://community.auth0.com/u/stephanie.chamblee)\
**Post date:** [March 2, 2021, 2:36pm UTC](https://community.auth0.com/t/check-session-without-extending-it/58569/5 "2021-03-02T14:36:26Z")

</div>

Hi @luke3,

You can use the `getTokenSilently` method to check on the session without extending it. If the token is valid, the token will be returned. If the user has a valid session that has not timed out, then a new token will be returned. Otherwise, a `login_required` error will be thrown.

To make sure this does not extend the session, I did a quick test in the [Vue Quickstart](https://auth0.com/docs/quickstart/spa/vuejs/01-login) by updating my tenant’s inactivity timeout to 3 minutes and the ID Token lifetime to 2 minutes and updated the app’s `src/components/NavBar.vue` file:

```auto
<script>
export default {
  name: "NavBar",
  methods: {
    login() {
      this.$auth.loginWithRedirect();
    },
    logout() {
      this.$auth.logout();
      this.$router.push({ path: "/" });
    },
    check() {
      const logout = this.logout;
      this.$auth.getTokenSilently().then((token) => {
        console.log(token)
      }).catch((e) => {
        console.error({e});
        if (e.error === 'login_required') {
          logout();
        }
      });
    }
  },
  mounted: function () {
    // Check every 10 seconds if their session exists with Auth0. If not, log them out.
    const CHECK_INTERVAL = 10000; // in ms
    const check = this.check;
    function initInterval() {
      setInterval(() => {
        check();
      }, CHECK_INTERVAL);
    }
    initInterval();
  }
};
</script>

```

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [March 17, 2021, 2:36pm UTC](https://community.auth0.com/t/check-session-without-extending-it/58569/6 "2021-03-17T14:36:57Z")

</div>

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.