# Session life time settings doesn't work correctly

**URL:** <https://community.auth0.com/t/session-life-time-settings-doesnt-work-correctly/124448>\
**Category:** Get Help\
**Tags:** sessions, logout\
**Created:** [January 9, 2024, 9:49am UTC](https://community.auth0.com/t/session-life-time-settings-doesnt-work-correctly/124448 "2024-01-09T09:49:02Z")\
**Posts on this page:** 1\
**Showing post:** 5

<div class="post-metadata">

**Author:** ![marcelina.barycka](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/marcelina.barycka/32/56162_2.png) [@marcelina.barycka](https://community.auth0.com/u/marcelina.barycka)\
**Post date:** [January 10, 2024, 1:25pm UTC](https://community.auth0.com/t/session-life-time-settings-doesnt-work-correctly/124448/5 "2024-01-10T13:25:33Z")

</div>

Hi @dabashin140504 !

Here are my reaserch results:

Users stay logged in irregardless of Login Session Management settings because of an auth cookie stored in browser, that is set after a user logged in. With an access to this cookie - user stays logged in and a [local session](https://auth0.com/docs/manage-users/sessions/session-layers) persist. (My colleague explained it well in this [topic](https://community.auth0.com/t/in-spa-authentication-how-does-auth0-remember-that-im-logged-in-on-page-refresh/74026/2))

> [@dabashin140504](#):
>
> Because in the token we have decoveToken. **exp** property, but this property isn’t for inactivity time.

Looking at our docs, the **exp** claim in the ID token can be used to determine when an app have to call the /logout endpoint.

The exp claim refers to the ID Token Expiration value and can be set set here:  
Auth0 tenant → Applications → your SPA app → Settings → Id token → ID Token Expiration.

Please let us know if you have some questions on this!

---

_[View the full topic](https://community.auth0.com/t/session-life-time-settings-doesnt-work-correctly/124448)._