JWT expiration 2 hours regardless of ID Token Expiration setting

Help
,
1

I have a Single Page Application, and under the Application Settings → Application Tokens → ID Token Expiration, I set the value to 86400.

However, the JWT received after the code exchange flow only has a 2 hour expiresIn value. Why is that?

2

Hey there!

Not sure what is happening here. Let me research that!

1 Like
4

Hi there!

I am facing the same issue. Was there a solution to this?

Best,
John.

5

@konrad.sopala do you have any update?

6

The expires_in response parameter which an SDK is likely mapping to expiresIn applies to the expiration of the access token (it is not the expiration of the ID token)

7

Thanks. Is there a way to increase the timeout of the access token, without renewing the session?

8

Technically yes but it’s not advisable:

You should be using short-lived tokens to minimize security risks.

9

Thank you. After the 2 hour expiration of the access token, can I renew it using the method webAuth.checkSession, or do I have to call webAuth.authorize()? (Auth0.js v9 Reference)

Currently, I have a silent auth flow, and if the parseHash comes back with an error of login_required, I am calling webAuth.authorize() again without prompt: "none". I am wondering, in the case of this error, that I should try doing webAuth.checkSession to renew the access token?

10

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.