Session idle timeout settings

[sagarshah1983]

Hello,
As I see in documentation, there's an option to remember the login request (so that login screen is not required again) using browser cookie (using remember and remember_for parameters). Is there an option to set the session using idle timeout?
So that it expires the session, only if user was inactive for certain amount of time?

Appreciate any inputs!

[vinckr]

Hey,
are you sure this is something you would want to configure in Hydra?
Maybe it is easier to take care of this in your application.

See this document for reference:
https://www.ory.sh/hydra/docs/concepts/before-oauth2#access-and-refresh-tokens-are-not-sessions

Your Application's Session Manager keeps track of the user within your application.
You will use OpenID Connect to initiate and complete the login, but your application needs to store and track and invalidate the session.

[sagarshah1983]

Thanks for replying. The use case I am trying to solve is single sign on.
So we have application A and B. Both are registered as oauth client.
When I login to A, I can launch application B without requiring user to login using browser session. But this would be good only as long as the session timeout is set on Auth server, correct? My Application session may be actively used by the user so that session is valid but the one on Hydra would not remain alive after exceeding remember_for time, so if user tries to launch App B from A, it would require him to login again. So trying to figure out if, is there any other way this could be managed in Hydra?

Appreciate your thoughts!

[sagarshah1983]

Also, I want to add a note, that there's no way to reset or bump the session timeout. Could that be added as an enhancement?
For example, I logged into the application using my credentials at 11 AM with session to be remember for 30. minutes.
I closed window and then again in about 25 minutes (11:25 AM) opened up with browser for same application and it will not ask me to login but just take my session from browser. But now in next 5 minutes, my session will be terminated so I may require login again. Could that session timeout be reset or bumped up on any next login attempt? Is that supported somehow in Hydra?

Appreciate your suggestions!

[aeneasr]

Resetting the session timeout directly contradicts ASL1 of the NIST Digital Identity Guidelines:

4.1.3 Reauthentication

Periodic reauthentication of subscriber sessions SHALL be performed as described in Section 7.2. At AAL1, reauthentication of the subscriber SHOULD be repeated at least once per 30 days during an extended usage session, regardless of user activity. The session SHOULD be terminated (i.e., logged out) when this time limit is reached.

While you don't need to implement that guidance, it is considered best practice to re-request authentication periodically. If you don't want that, just set the session lifetime to a year.

[sagarshah1983]

Thanks for bringing this to my notice. I guess I could still use id_token_hint to perform auth (as long as prev id token was not expired - by checking it in login endpoint) and set new id token in user's session in application.