How to add a timeout system to my API Management Developer Portal?

Question

I have an API Management developer portal (standard tier) that I want users to be timed out of after inactivity. I've been testing my developer portal and it seems that the user will stay signed in even if they do not interact with the webpage. I am using B2C as the sign in / sign up system. How would I go about timing out users?

I've tried adjusting the "Access & ID token lifetimes" to 15 minutes in B2C however it still does not do anything. I've also adjusted the "Web app session lifetime" in B2C to 15 minutes and the user still stays signed in. What should I do? If relevant, the web app session timeout is set to "absolute". Thank you in advance.

Answer 1

Hi @hampton123

Thank you for post!

Refresh tokens issued to SPAs cannot be controlled via B2C Sessions Management and are valid for 24 hours only. So, in your case, you need to make sure that the offline_access scope is not present in the authentication request to make sure the refresh token is not issued.

As documented under Security implications of refresh tokens in the browser, without refresh tokens or third-party cookies, the authorization code flow (as recommended by the OAuth security best current practices draft) becomes onerous when new or additional tokens are required. A full page redirect or popup is needed for every single token, every time a token expires (every hour usually, for the Microsoft identity platform tokens).

Please check if you have added the offline_access scope for the application registered in the Azure AD B2C tenant. If it is added and consented as shown below, try removing the permission and send the authentication request again.

Hope this helps. Do let us know if you any further queries.

Thanks,

Akhilesh.

---

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.