# Is it possible to use Auth0 for long-term web authentication?

**URL:** <https://community.auth0.com/t/is-it-possible-to-use-auth0-for-long-term-web-authentication/20550>\
**Category:** Get Help\
**Created:** [January 25, 2019, 2:25pm UTC](https://community.auth0.com/t/is-it-possible-to-use-auth0-for-long-term-web-authentication/20550 "2019-01-25T14:25:46Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![pimterry](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/pimterry/32/10679_2.png) [@pimterry](https://community.auth0.com/u/pimterry)\
**Post date:** [January 25, 2019, 2:25pm UTC](https://community.auth0.com/t/is-it-possible-to-use-auth0-for-long-term-web-authentication/20550/1 "2019-01-25T14:25:46Z")

</div>

Is there any suggested way to use Auth0 for long-term web authentication? I’ve seen various other threads suggesting that it’s impossible to keep a user logged in if they don’t use your web app for more than 3 days, and even if they use it every day, it’s impossible to keep them more logged in for more than 30 days.

Is this accurate? It does seem reasonable as a default, but it’s a very harsh hard limit. I can think of lots of popular web applications that keep me logged in more or less indefinitely (certainly for more than 3 days inactive), and I suspect many users assume this behaviour by default. More practically, indefinite authentication with manual revocation is a strict requirement for my current project.

For context, the _only_ data I store associated with users is their email & current subscription status. Even in a browser, I think the chance of a refresh token being leaked is very low, and the damage if that does happen is minimal (other than the leak of their email address, it’s entirely to my own business: if user B steals a token then they can use user A’s subscription). As a hard requirement though, I do need to be able to confirm users’ subscription status reliably without asking them to log in every week, and I really don’t want to have to build my own authentication infrastructure to do so.

Is there any way (even if normally strongly discouraged) to use refresh tokens on the web, so I can work around this?

---

<div class="post-metadata">

**Author:** ![pimterry](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/pimterry/32/10679_2.png) [@pimterry](https://community.auth0.com/u/pimterry)\
**Post date:** [January 25, 2019, 3:23pm UTC](https://community.auth0.com/t/is-it-possible-to-use-auth0-for-long-term-web-authentication/20550/2 "2019-01-25T15:23:03Z")

</div>

Found it! You can indeed work around this, and the result actually works very nicely:

- Disable ‘OIDC Conformant’ in ‘Advanced Options’ → ‘OAuth’ for your application
- Authenticate with a `scope` parameter including `offline_access` in the UI, e.g. with Lock v11:

```auto
const lock = new Auth0Lock('...', '...', {
    ...
    auth: {
        params: { scope: 'openid email offline_access' },
    }
}

```

After authenticating, the auth result in `authenticated` events from the lock now includes `refreshToken`, which you should be able to use with [Refresh Tokens](https://auth0.com/docs/tokens/refresh-token/current#use-a-refresh-token) to refresh. In my case, I’m using `auth0-js` and doing:

```auto
const client = new Auth0.Authentication({
    clientID: '...',
    domain: '...'
});
client.oauthToken({
    refreshToken: authResult.refreshToken, // from the authentication event
    grantType: 'refresh_token'
}, (error, result) => {
    result.accessToken // Fresh refreshed access token
});

```

I’m sure this is discouraged, and I do agree that if you’re protecting sensitive data or operations, you should ensure users reauthenticate frequently. I definitely don’t agree that every application is doing that though, and being able to opt-out of that and take responsibility for session expiry myself is very useful to me.

The refresh step here is more or less verbatim from the latest react native SDK, so should keep working for as long that’s supported. The initial login step to get that refresh token is that part that depends on non-OIDC behaviour (specifically: refresh tokens must be allowed for implicit grants), so might stop working if that is removed in future. It doesn’t sound like that’s happening any time soon though, and the current docs say this’ll be available ‘until further notice’. I’d like to find an alternative that doesn’t require this, but it seems that’s not currently available.

It’d be interesting to hear thoughts from anybody at Auth0 if there’s any more specific info on when that might happen, or whether there’s any other major caveats to the above.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [February 9, 2019, 3:36pm UTC](https://community.auth0.com/t/is-it-possible-to-use-auth0-for-long-term-web-authentication/20550/3 "2019-02-09T15:36:59Z")

</div>

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.