Repository navigation
Replies: 1 comment
|
Some excellent explanation here - and details from keycloak website |
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
So I think I'm grasping what a realm's token configurable lifetimes mean. Let's put it in terms of a web application.
We have:
Then we have:
Okay.. now I'm interested in some guidance as compared to other online services.
Take a banking site: Surely SSO Session Max should be rather short (say 24 hours). And the SSO Session Idle time should be shorter (say 15 minutes), and the Access Token Lifespan should be pretty short, say 1-5 minutes. That makes sense, and is what I experience with online banking sites.
But take a more casual consumer service like Spotify, Netflix, or Pay-for AI Image generation. The consequences of compromise are much lower. In my experience, these sites rarely (if ever?) require to you log in again. You conveniently open your browser and you're still in until you explicitly log out.
I also understand that linked devices (e.g. a TV linked to your Netflix account) would be using an Offline Access token, and those don't typical expire. You can remove their access from the website usually, and those tokens have more limited rights anyway.
But in these cases, where in the web browser I seem to be logged in forever, is this just essentially a SSO Session Max of several years?, and maybe a SSO Session Idle of maybe 30 days or a year? Or is it essentially an infinite SSO Session Max with SSO Session Idle time of several years? What's typically the case here?
Thanks
All reactions