Token lifetime / Expiration

[Schoof-T]

I'm trying to understand the BFF pattern better and I have a question.

How do we check if the access token we are using is still valid? Should we not be redirected to the login page after a certain period, or is all of that handles automatically by some middleware? How is this checked and performed?

Currently it seems to me, once you login, you're logged in forever. The auth cookie / token just seem to stay valid forever, I can leave the application, come back the next day and still be signed in.

Sorry if this is not the correct place to ask this, but I wasn't sure where else to. 😅

Thanks

[damienbod]

Hi @Schoof-T When you get the AT back from the identity provider. a expired by property is also returned. You need to read this and set the cache to expire or implement the refresh process using this

Greetings Damien

[Schoof-T]

Thanks! Would be nice to have an example of this in the template, I feel like it's something every application needs right?

[damienbod]

True, I wanted to keep the template basic, I should have an example somewhere, if not I will crate one, but I am busy and have a backlog infront of this

Greetings Damien