# Session layers
## The three layers
1. Auth0 SSO session: the cookie on your tenant domain. Tenant Settings > Advanced > Login Session Management: idle timeout and absolute timeout. This is what makes the second app's login instant.
2. Application session: your app's own cookie/session (express-openid-connect session, Next.js SDK session, Django session). Its lifetime is your code's config.
3. Refresh token chain (SPAs/native): absolute + inactivity lifetimes, with rotation.
## How they interact
- App session dies, SSO alive: next visit re-authenticates silently (good UX, no password).
- SSO dies, app session alive: user keeps using the app until the app session dies, then must fully log in.
- "Logout" should clear the app session AND hit /v2/logout to clear the SSO session, or layer 1 resurrects the user.
## Recommended stack
- SSO absolute: 7 days; SSO idle: 3 days (tenant level).
- App session: match or shorter than SSO idle.
- SPA refresh: absolute 30 days, inactivity 7 days, rotation on.
- High-security apps: shorten SSO idle to hours and require step-up MFA for sensitive actions instead of killing the whole session.
## Rolling vs absolute
Idle timeouts roll on activity; absolute timeouts do not. Users hate absolute-only short sessions (logged out mid-work); auditors hate idle-only long sessions. Set both, deliberately.
## Checklist
- All three layers' numbers written in the runbook.
- Logout clears every layer the product promises to clear.