I’m trying to implement an inactivity timer for my React SPA using the approach suggested here: Session Lifetime Limits. As I have implemented it, the timer will be (re-)set each time the user obtains a new token. (That is my interpretation of the following sentence: “Each time a token is returned to the application, reset the timer.”) I am using refresh tokens, so a new access token is regularly generated through a request to the /oauth/token
endpoint. Through some preliminary testing I’ve determined that the session is not being extended by this action. That is, calling getAccessTokenSilently()
will throw an error with message Login required
after the idle session lifetime has passed. This seems to conflict with the idea of the user being “inactive” or “idle”.
Client settings:
{
"refresh_token": {
"expiration_type": "expiring",
"leeway": 3600,
"token_lifetime": 3600,
"idle_token_lifetime": 3500,
"infinite_token_lifetime": false,
"infinite_idle_token_lifetime": false,
"rotation_type": "rotating"
}
}
Tenant settings:
{
"idle_session_lifetime": 1,
"session_lifetime": 168
}