Session layers: SSO cookie, app session, idle and absolute timeouts

Session layers

The three layers

1. Auth0 SSO session: the cookie on your tenant domain. Tenant Settings > Advanced > Login Session Management: idle timeout and absolute timeout. This is what makes the second app's login instant.
2. Application session: your app's own cookie/session (express-openid-connect session, Next.js SDK session, Django session). Its lifetime is your code's config.
3. Refresh token chain (SPAs/native): absolute + inactivity lifetimes, with rotation.

How they interact

• App session dies, SSO alive: next visit re-authenticates silently (good UX, no password).
• SSO dies, app session alive: user keeps using the app until the app session dies, then must fully log in.
• "Logout" should clear the app session AND hit /v2/logout to clear the SSO session, or layer 1 resurrects the user.

Recommended stack

• SSO absolute: 7 days; SSO idle: 3 days (tenant level).
• App session: match or shorter than SSO idle.
• SPA refresh: absolute 30 days, inactivity 7 days, rotation on.
• High-security apps: shorten SSO idle to hours and require step-up MFA for sensitive actions instead of killing the whole session.

Rolling vs absolute

Idle timeouts roll on activity; absolute timeouts do not. Users hate absolute-only short sessions (logged out mid-work); auditors hate idle-only long sessions. Set both, deliberately.

Checklist

• All three layers' numbers written in the runbook.
• Logout clears every layer the product promises to clear.

Auth0's tenant settings document login session management (idle and absolute SSO timeouts). Application session handling is in each SDK's docs; refresh token lifetimes in the rotation doc. Verified against live docs 2026-09-26.