# Unlimited Refresh Token - site never auto-logs out

**URL:** <https://devforum.okta.com/t/unlimited-refresh-token-site-never-auto-logs-out/22771>\
**Category:** OAuth/OIDC\
**Tags:** reactjs\
**Created:** [December 13, 2022, 12:57am UTC](https://devforum.okta.com/t/unlimited-refresh-token-site-never-auto-logs-out/22771 "2022-12-13T00:57:53Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![BirdThunderford](https://avatars.discourse-cdn.com/v4/letter/b/e9c0ed/32.png) [@BirdThunderford](https://devforum.okta.com/u/BirdThunderford)\
**Post date:** [December 13, 2022, 12:57am UTC](https://devforum.okta.com/t/unlimited-refresh-token-site-never-auto-logs-out/22771/1 "2022-12-13T00:57:53Z")

</div>

Hi,

I’ve been experimenting with the refresh token to try and get my SPA app to automatically log out after a certain time limit.  
It’s been successful if I specify a limited time refresh token ie

 ![image](https://global.discourse-cdn.com/oktadev/original/2X/b/b981442d1993a284946bb150e86998e8a3aecd69.png)

However if I specify an unlimited refresh token it never logs out. In fact the only way I can  
tell that the token is invalid is anytime I submit a request to my backend (django) authorization server and I get a token error.

Is there anything I have to do differently with my app in order to make this work? Right now everything regarding the token validation is handled under the hood so I’m not actually doing anything differently to log out _if_ I specify a limited refresh token lifetime.

Happy to share whatever extra info I can. I’m just not sure what is pertinent in this case.

My front-end is using okta-auth-js and okta-react.

Thanks!

---

<div class="post-metadata">

**Author:** ![BirdThunderford](https://avatars.discourse-cdn.com/v4/letter/b/e9c0ed/32.png) [@BirdThunderford](https://devforum.okta.com/u/BirdThunderford)\
**Post date:** [December 15, 2022, 10:44pm UTC](https://devforum.okta.com/t/unlimited-refresh-token-site-never-auto-logs-out/22771/2 "2022-12-15T22:44:39Z")

</div>

Just bumping this to see if anyone has any insight.

Particularly if someone could explain what would happen if, for instance, my settings were:

 ![image](https://global.discourse-cdn.com/oktadev/original/2X/f/f8a04562610da0c6b054dd509e43ac64b6d92da9.png)

I would take this to mean that after 5 minutes the access token expires but the refresh token is used to get a new access token. This refresh token will never expire unless the app(?) is used every 10 minutes?

This is where I get a bit confused - _but will expire if not used every_ is a bit vague. What is being used?

If i set the refresh token lifetime to 10 minutes instead of unlimited, the app logs out after about 20 minutes or so - kinda what I’m expecting.

So what should happen in the case of an unlimited token?

Thanks again!

---

<div class="post-metadata">

**Author:** ![erik](https://avatars.discourse-cdn.com/v4/letter/e/b5ac83/32.png) [@erik](https://devforum.okta.com/u/erik)\
**Post date:** [December 15, 2022, 11:53pm UTC](https://devforum.okta.com/t/unlimited-refresh-token-site-never-auto-logs-out/22771/3 "2022-12-15T23:53:17Z")

</div>

Hello @BirdThunderford,

If,  
access\_token = 5 minutes  
refresh\_token = unlimited  
but\_will\_expire = 10 minutes

Then the access\_token always is only good for 5 minutes.  
The refresh\_token will never expire if it is used at least once every 10 minutes to get a new access\_token. Once it is used the 10 minute window starts over.  
I there is ever a period where 12 minutes has elapsed since the last time the refresh\_token was used to get an access\_token it will no longer be valid.

Also note that if the refreh\_token lifetime was set to 1 hour instead with the other settings the same. Even if the refresh\_token was used every 8 minutes after 1 hour it sill would be invalid at that point.

Thank You,

---

<div class="post-metadata">

**Author:** ![BirdThunderford](https://avatars.discourse-cdn.com/v4/letter/b/e9c0ed/32.png) [@BirdThunderford](https://devforum.okta.com/u/BirdThunderford)\
**Post date:** [December 16, 2022, 3:40am UTC](https://devforum.okta.com/t/unlimited-refresh-token-site-never-auto-logs-out/22771/4 "2022-12-16T03:40:40Z")

</div>

Thanks for getting back to me.

So from what I’m experiencing, it looks like my app is checking for an access token every 5 minutes:

![Screen Shot 2022-12-15 at 4.41.08 PM](https://global.discourse-cdn.com/oktadev/original/2X/6/6d72d3a80d53b54dad63f226019c307edf1e5816.png)

Which from the access token lifetime settings seems to make sense.

So each time it calls back to check the token, its using that unlimited refresh token to authenticate against.

Each time this happens the refresh token restarts the 10-minute clock.

So if I never leave this page it will never log me out?

Now if I leave the page, and wait a bit and come back, it does prompt me to log back in but I never have to put in my password.

It just doesn’t behave the same way that having a limited refresh token does (logging me out completely after the refresh token expires). So perhaps I’m just misunderstanding what’s supposed to happen if I have an unlimited refresh token. I don’t see the point of the _but will expire if not used every_ option if it never actually invalidates the refresh token.

---

<div class="post-metadata">

**Author:** ![jmussman](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/jmussman/32/2175_2.png) [@jmussman](https://devforum.okta.com/u/jmussman)\
**Post date:** [December 21, 2022, 5:27pm UTC](https://devforum.okta.com/t/unlimited-refresh-token-site-never-auto-logs-out/22771/5 "2022-12-21T17:27:48Z")

</div>

Hi!

I am a bit confused by your question. Specifically what you mean by auto-logging out of the SPA, and that the “authorization server” is where you get a token at Okta, your backend would be the “resource server”? But taking my best guess this may help you:

The only purpose of a refresh token is to obtain an updated access token. When a refresh token expires that does not log the user out of your Okta org. So the purpose of an access token is to prove to the resource server (your web service, API, backend…) that the client application is authorized to do certain operations (the scopes). The access token has nothing to do with the concept of being “logged in”, and in fact could expire AFTER the Okta session has already expired. And again, an access token expiring does not log the user out of your Okta org.

If you are trying to force a logout of the SPA, just clear your token cache and when the user tries to do something the SPA will have to get a new token again. If they still have a session at Okta they don’t have to re-authenticate. If you are trying to force them to log out of the Okta org then in the SPA dump the token cache and use the “sessions” API at Okta to terminate their session at the org.

---

<div class="post-metadata">

**Author:** ![BirdThunderford](https://avatars.discourse-cdn.com/v4/letter/b/e9c0ed/32.png) [@BirdThunderford](https://devforum.okta.com/u/BirdThunderford)\
**Post date:** [January 12, 2023, 11:39pm UTC](https://devforum.okta.com/t/unlimited-refresh-token-site-never-auto-logs-out/22771/6 "2023-01-12T23:39:30Z")

</div>

Apologies. I was mixing my terminology. Yes, I meant resource server.

I should probably restate my intentions as well. I’d like to have the application log the user out if it sits idle for too long or generally has been logged in for a certain period of time.

There’s a lot of settings in the okta dashboard that I think should be what I need to set but in setting them I don’t actually know if I’m causing more trouble than I’m resolving.

My apps settings:

 ![image](https://global.discourse-cdn.com/oktadev/original/2X/5/553ce7bdf8af2f2543ae3e730f10d6563f6f14f2.png)

I also added a sign-on policy for the app that looks like this:  
 ![image](https://global.discourse-cdn.com/oktadev/original/2X/f/fa68b46698510b1265b52d8162d6ce4a37b05a04.png)

I’ve also set up an access policy in the security API:

 ![image](https://global.discourse-cdn.com/oktadev/original/2X/6/69f995d56eeba72d8c2426c34a7005c82cfcdab1.png)

As far as my code, its pretty boilerplate okta-auth js.

```auto
import { Component, Fragment, lazy, Suspense } from 'react';
import { Switch, Route, Router } from 'react-router-dom';
import * as ReactDOMClient from "react-dom/client";

import { Security, LoginCallback, SecureRoute } from '@okta/okta-react';
import { OktaAuth, toRelativeUrl } from '@okta/okta-auth-js';

import { CacheProvider } from '@emotion/react';
import createCache from '@emotion/cache';

import { createBrowserHistory } from 'history';

import Box from "@mui/material/Box";

import LoadingIcon from './common/components/LoadingIcon';

const Home = lazy(() => import('./apps/Main/Home'));
const Login = lazy(() => import('./apps/Main/Login'));

const history = createBrowserHistory();
const cache = createCache({
  key: 'a-key',
  nonce: __webpack_nonce__ ,
  prepend: true,
});

const config = {
  issuer: process.env.OKTA_ISSUER,
  clientId: process.env.OKTA_CLIENT_ID,
  redirectUri: window.location.origin + '/oidc/callback',
}

class App extends Component {
  constructor(props) {
    super(props);
    this.oktaAuth = new OktaAuth(config);
    
    this.restoreOriginalUri = async (_oktaAuth, originalUri) => {
      props.history.replace(toRelativeUrl(originalUri, window.location.origin));
    };

    this.authRedirect = (oktaAuth) => {
      history.push('/login');
    };
    
  }

  render() {
    return (
      <Security
        oktaAuth={this.oktaAuth} 
        restoreOriginalUri={this.restoreOriginalUri}
        onAuthRequired={this.authRedirect}
      >
        <CacheProvider value={cache}>
          <Box
            id='app-root-container'
            sx={{
              display: 'flex',
              flexDirection: 'column',
              height: '100vh',
              m: -1,
            }}
          >
            <Fragment>
              <Suspense fallback={<LoadingIcon />}>
                <Switch>
                  <SecureRoute exact path='/' component={Home} />
                  <Route exact path='/login' component={Login} />
                  <Route exact path='/oidc/callback' component={LoginCallback} />
                </Switch>
              </Suspense>
            </Fragment>
          </Box>
        </CacheProvider>
      </Security>      
    );
  }
}

const container = document.querySelector("#app");
const root = ReactDOMClient.createRoot(container);
root.render(
  <Router history={history}>
    <App history={history} />
  </Router>
);

```

I have my primary route as secure route and let okta-auth-js do all the work.  
Perhaps I misunderstood what okta-auth-js is doing because I figured I could have the app log out after a certain amount of time by just making configurations in the okta app dashboard. But again, maybe I set something that’s cancelling something else out. I’m honestly not sure.

In the end all I want to do is determine that a user has gone past a certain amount of idle or login time and the app logs out. If its something I have to do in code, that’s fine. I just need to know what piece of the puzzle I’m missing.

Hope this helps to clarify.

Thanks!

---

<div class="post-metadata">

**Author:** ![BirdThunderford](https://avatars.discourse-cdn.com/v4/letter/b/e9c0ed/32.png) [@BirdThunderford](https://devforum.okta.com/u/BirdThunderford)\
**Post date:** [January 19, 2023, 11:53pm UTC](https://devforum.okta.com/t/unlimited-refresh-token-site-never-auto-logs-out/22771/7 "2023-01-19T23:53:45Z")

</div>

I’m continuing to experiment with this and I think I understand what the unlimited refresh token is referring to. What I am confused by still is that if an access token lifetime is shorter than the refresh token is longer than this, that refresh token will always be used anytime the access token needs to be renewed.

So in what case will an unlimited refresh token ever be invalid?

I tried some new settings just to see what happens when I define a finite refresh token:

 ![image](https://global.discourse-cdn.com/oktadev/original/2X/3/3d3818a5f870867ac54d51abca61396865f0b596.png)

And I think i see what’s happening. Once the refresh token expires I get

> OAuthError: the refresh token is invalid or expired

But what I’d prefer to do is catch this error so I can log out gracefully. Is there any way I can do this?

I’m doing something like

```auto
authClient.on('error' (key) {
  console.log(key)
});

```

to determine what was failing. So I guess I’m not sure what exactly is going on to force the logout but I’d like to be able to stop it before it happens.

Any thoughts?

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [February 13, 2024, 5:20pm UTC](https://devforum.okta.com/t/unlimited-refresh-token-site-never-auto-logs-out/22771/8 "2024-02-13T17:20:31Z")

</div>

Closed on February 13, 2024, 5:20pm UTC