Session not extended by token exchange

[edwindwalker]

I’m trying to implement an inactivity timer for my React SPA using the approach suggested here: Session Lifetime Limits. As I have implemented it, the timer will be (re-)set each time the user obtains a new token. (That is my interpretation of the following sentence: “Each time a token is returned to the application, reset the timer.”) I am using refresh tokens, so a new access token is regularly generated through a request to the /oauth/token endpoint. Through some preliminary testing I’ve determined that the session is not being extended by this action. That is, calling getAccessTokenSilently() will throw an error with message Login required after the idle session lifetime has passed. This seems to conflict with the idea of the user being “inactive” or “idle”.

Client settings:

{
    "refresh_token": {
        "expiration_type": "expiring",
        "leeway": 3600,
        "token_lifetime": 3600,
        "idle_token_lifetime": 3500,
        "infinite_token_lifetime": false,
        "infinite_idle_token_lifetime": false,
        "rotation_type": "rotating"
    }
}

Tenant settings:

{
    "idle_session_lifetime": 1,
    "session_lifetime": 168
}

[rueben.tiow]

Hi @edwindwalker,

I recommend referring to our Inactivity Timeout and Refresh Token Exchanges knowledge articles, which address the issue of using refresh tokens.

You may also find our Session Management - Login Issues and Staying Logged In knowledge article helpful.

Let me know if you have any follow-up questions.

Thanks,
Rueben

[edwindwalker]

I have reconfigured my Auth0Provider to not use refresh tokens and, despite regular calls to the /authorize endpoint, after 60 minutes I am redirected to the login page. I do not have to re-enter my details. The following error is being thrown:

[rueben.tiow]

Hi @edwindwalker,

Thanks for the update.

Since you are using a React SPA, you should use silent authentication to extend the user’s session without requiring user interaction. Refresh tokens are typically designed for regular web applications, as noted in this documentation.

Thanks,
Rueben