1

I have a React app that uses Azure B2C to authenticate users (PKCE flow). There is a requirement to keep the session active as long as the user has some activity.

I cannot use "Rolling" for session timeout, because some of the requests are made by an independent job, which is not triggered by the user.

Here is my question - how can I control renewing the session? I would like to renew the session every time I am getting the access token.

Michson07
  • 73
  • 1
  • 5

1 Answers1

1

Access tokens and ID tokens are short-lived. Since you are using the Authorization-Code Grant flow of OAuth, after they expire, you must refresh them to continue to access resources .

Hence in order to get the refresh-token, you would have to send a POST request to the /token endpoint of B2C with the scope .(i.e; Provide the refresh_token instead of the code in the rquest).see reference 1.

Make sure to add scopes along with AppId 'openid profile offline_access AppId’

Ex: scope: 'openid profile offline_access XXXXXX-f9a4-4b8e-XXXX-dXXXXXXX01f'

References:

  1. Authorization code flow - Azure Active Directory B2C | Microsoft Docs
  2. microsoft-authentication-library-for-js/FAQ (github.com)
kavyaS
  • 8,026
  • 1
  • 7
  • 19
  • Thanks for the answer. I'm new in the B2C, so could you please tell me how getting the refresh token is related to renewing/extending the session? – Michson07 Feb 21 '22 at 21:06