We have a React application in which some users are reporting intermittent automatic logouts. Users are being prompted to re-authenticate with Okta even though the session timeout is configured for 2 hours. In several cases, re-authentication is required in less than the configured timeout period.
The issue occurs intermittently and we have not been able to reproduce it in our environment. We are looking for guidance on potential causes or configuration issues that could lead to this behavior, as well as any recommended troubleshooting steps or fixes.
we are using idp_sso_url to login
Hi @Harlem ManzanoHere are few considerations:
Below are the actual settings that matter for your issue:
1. Verify Okta Token Lifetimes
Go to:Security → API → Authorization Servers → Access Policies → Token Lifetime
Check:
2. Enable “Refresh Token Rotation” (Strongly Recommended)In Okta Admin:
I hope it helps!!
Hi,
i also think same as Narendra. u can use access token in this case and access token have expiretime less than 120mins and if access token expired, the system log out.
u need have logic to refresh token and keep user not log out.
Hope this helps!
I don't think this issue is related to the Okta admin settings, as the behavior is inconsistent across devices. It works as expected on some devices, while others experience the issue intermittently.
Here is the expected behavior based on our current logic:
I temporarily set the Maximum Idle Time to 10 minutes for testing purposes.
Once the user's maximum idle time is reached, they should be redirected to the Okta page. If the Okta session is still active, the user should be able to access the Okta page without being prompted to reauthenticate.
However, we are experiencing inconsistent behavior. Sometimes this works as expected, but other times the Okta session also expires, even after just 10 minutes of inactivity.
We are currently testing this scenario using an iPhone.
Could you give us some idea why the Okta session is sometimes expiring earlier than expected?