## TL;DR

Idle timeouts roll on activity; absolute timeouts do not. Users hate absolute-only short sessions (logged out mid-work); auditors hate idle-only long sessions.

## Steps

1. - SSO absolute: 7 days; SSO idle: 3 days (tenant level).
- App session: match or shorter than SSO idle.
- SPA refresh: absolute 30 days, inactivity 7 days, rotation on.
- High-security apps: shorten SSO idle to hours and require step-up MFA for sensitive actions instead of killing the whole session.

## When to use

You are seeing this: Auth0 SSO session: the cookie on your tenant domain. Use this skill when you run into "Session layers: SSO cookie, app session, idle and absolute timeouts".

## When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

## Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

## Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.