Based on my understanding, this code(https://github.com/medplum/medplum/blob/9d1cc0ff89b618c7f8fe9d567bee8d73c1de19fe/packages/server/src/oauth/authorize.ts#L152C1-L173C2) explains why a user is automatically logged out after an hour of inactivity on the client side. The system tracks the user's session duration when there is no active interaction. As long as the user remains active and the access token is valid, they can stay logged in. If the access token expires but the refresh token is still valid, the system will use the refresh token to obtain a new access token, extending the session (by another hour, please correct me if I was wrong). However, if the user is inactive for over an hour, this code will execute a check. Specifically, it retrieves login information through either the getExistingLoginFromIdTokenHint or getExistingLoginFromCookie methods and verifies the authTime to determine the last time the user actively interacted with the system. If the time elapsed since authTime exceeds the maximum session duration (e.g., one hour), the user is forced to re-authenticate, even if the refresh token is still valid. In other words, this code manages session validity based on user activity duration, rather than solely relying on token expiration. As long as the user remains active and the tokens can be renewed, they can stay logged maximum of 2 weeks. But once the session’s idle time surpasses the allowed threshold, even with a valid refresh token, the user will be required to log in again. If my understanding is incorrect, please let me know. Thanks!

Hi @reshma @rahul1 @andrei_60331 , Would appreciate comment on this. In order to pass a security test, we want to know which code segment defines the timeout period for terminating a session within the application for the end user.