Auth0 Users Remain Logged In After the Inactivity Timeout
Last Updated:
Overview
Users remain logged in after the inactivity timeout expires because the application does not clear the session when the Auth0 session expires. Resolve this by configuring the inactivity timeout and absolute expiration in the tenant settings and controlling the local application session duration. In this scenario, an administrator sets the Refresh Token Inactivity Expiration to 15 seconds in the application settings and configures the Login Session Management to a non-persistent session with a 1-minute inactivity timeout and a 60-minute absolute expiration. However, the web application remains active after the 15-second timeout window expires, after 1 minute of inactivity, or after the application is closed and reopened.
Applies To
- Auth0
- Access Token
- Sessions
- Authentication
Cause
Session lifetime and refresh token lifetime operate independently. The refresh token can expire even while the application retains an Auth0 session cookie indicating the user is still logged in. Users remain logged in after the inactivity timeout because the application does not clear the session when the Auth0 session expires. Additionally, tenant settings cannot enforce non-persistent sessions if the user enables a session restore setting on the browser, which restores the session cookie. Furthermore, if a user closes a tab but not the browser window, the browser does not clear the session cookie until the session ends, either due to idle time or absolute expiration.
Solution
Why do users remain logged in after the inactivity timeout?
Auth0 creates sessions on three different layers:
- An application session.
- An Auth0 session.
- An Identity Provider (IdP) session.
The Session Management documentation explains the session layers and how to control the local application session duration of the user.
What steps configure the inactivity timeout to force re-authentication?
Force users to re-authenticate and start a new session by configuring the inactivity timeout and absolute expiration in the tenant settings.
- Navigate to Tenant Settings.
- Select the Advanced tab.
- Configure the Inactivity Timeout and the Require Login After lifetimes.
