CODEWITHSUNDEEP
authenticationoauthoauth-2.0openid-connectrefresh-token
Alexander Nied
Alexander Nied

Reputation: 13633

OAuth2: Is the `auth_time` claim tied to the refresh token expiration?

If I know that my auth provider sets refresh tokens to expire after twelve hours, and I have authenticated and my auth_time claim shows as 9AM today, can I safely assume that at 9PM tonight my refresh token will expire? Or are auth_time and refresh token issuance/expiration independent of one another?

Upvotes: 1

Views: 2039

Answers (1)

Tore Nestenius
Tore Nestenius

Reputation: 19921

It depends on the auth provider, but in some providers you can set difference expire times on the different tokens (id/access/refresh). Also some supports absolute or sliding expiration times.

Sample expire config options for IdentityServer can be found here for inspiration.

Upvotes: 2

Related Questions