# Sanity checking refresh token expiration

**URL:** <https://community.auth0.com/t/sanity-checking-refresh-token-expiration/50679>\
**Category:** Get Help\
**Tags:** refresh-tokens\
**Created:** [September 29, 2020, 7:57pm UTC](https://community.auth0.com/t/sanity-checking-refresh-token-expiration/50679 "2020-09-29T19:57:47Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![cwaugh](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/cwaugh/32/16454_2.png) [@cwaugh](https://community.auth0.com/u/cwaugh)\
**Post date:** [September 29, 2020, 7:57pm UTC](https://community.auth0.com/t/sanity-checking-refresh-token-expiration/50679/1 "2020-09-29T19:57:47Z")

</div>

I have a site that users can log into, close, then re-open a day later, and be automatically silently logged in. This is not desired behavior, as the user should be required to enter their credentials again after a long period of inactivity. In an effort to create this behavior, I set the application’s id token expiration and refresh token lifetime to 60 seconds. I also set the audience api’s token expiration and token expiration for browser to 60 seconds. Alas, to no avail, as a user that logs in, closes the webpage, then returns after a long period still gets silently logged in.

Looking at the payload of the token, it’s easy to see that the expiration of the token is, in fact, a mere 60 seconds after the issuing of the token. This leads me to suspect the refresh token is to blame. The refresh token itself has a rotating behavior with a refresh token lifetime of 60 seconds (recommended for SPA applications), and a refresh token reuse interval of 0 seconds.

Any advice on forcing the user to log in again, even if that means disabling refresh tokens entirely, would be greatly appreciated.

---

<div class="post-metadata">

**Author:** ![john.gateley](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/john.gateley/32/10879_2.png) [@john.gateley](https://community.auth0.com/u/john.gateley)\
**Post date:** [September 30, 2020, 1:54pm UTC](https://community.auth0.com/t/sanity-checking-refresh-token-expiration/50679/2 "2020-09-30T13:54:32Z")

</div>

Hi @cwaugh

This is the session, not the access or id token (or refresh token).

Go to your dashboard, open up the tenant settings, and look under the advanced tab for your session timeouts.

John

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [October 15, 2020, 1:54pm UTC](https://community.auth0.com/t/sanity-checking-refresh-token-expiration/50679/3 "2020-10-15T13:54:41Z")

</div>

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.