Increase refresh token lifetime in B2C custom policy

Viewed 2998
2 Answers

What Parakh said is correct but please take note of the banner on the page that he linked to which says the following about SPA apps with PKCE:

Note
Single-page applications using the authorization code flow with PKCE always have a refresh token lifetime of 24 hours while mobile apps, desktop apps, and web apps do not experience this limitation. Learn more about the security implications of refresh tokens in the browser.

That means that settings such as the following may not be respected for those apps:

  • refresh_token_lifetime_secs
  • rolling_refresh_token_lifetime_secs
  • allow_infinite_rolling_refresh_token
    • This last one is never respected for SPA w/ PKCE
Related