Hello, I'm wondering what are the steps to increase the duration of the session. Let me explain my issue : I have a mobile application that records a night of sleep, the patient starts the recording at the beginning of the night, and then doesn't touch the phone for the night (several hours). In the morning the patient clicks on a button to finish the Procedure. But at that point the access token is not working anymore, and from my understanding, the refresh token neither. Can you guide me on the steps to increase the session duration ? I'm on a self hosted AWS. Thank you.

HI @thomabig , as a security best practice we we set access tokens to 1hr. However, refresh tokens are active for 2 weeks

Thanks for your answer @rahul1 So just to be sure I can be inactive for two hours for example and then use the refreshToken to get a new token ? Can you please confirm that these timelines are correct ? I've been trying to understand everything through the code but that was not fully clear to me ! One thing that I did not fully understand is how do we verify case 4 ? Meaning when is it verified the the refresh_token is expired. The only code I saw where "time" is mentionned during the refresh token process is the following :

// Use a timing-safe-equal here so that we don't expose timing information which could be
  // used to infer the secret value
  if (!timingSafeEqualStr(login.refreshSecret, claims.refresh_secret)) {
    sendTokenError(res, 'invalid_request', 'Invalid token');
    return;
  }

But I'm not sure what timingSafeEqualStr means. And not sure this is the piece of code that makes the refresh token not available anymore.

Hi @thomabig circling back here

Thank you 🙂