VERISCO Shield Authenticate
Session policy
How long a sign-in lasts, how long it survives without activity, and how tokens behave.
Set on Session Policy in your console.
Settings#
| Setting | Default | Meaning |
|---|---|---|
| Session idle timeout | 15 minutes | A session with no request for this long ends. The user signs in again. |
| Session max lifetime | 8 hours | A session ends this long after sign-in, however active it is. |
| Access token lifetime | Set per tenant | How long the short-lived token behind a session is valid before it is renewed. |
| Token reuse | Set per tenant | Whether a refresh token may be used more than once. |
| Remember me | Set per tenant | Whether users may ask to stay signed in across browser restarts. |
Where it is enforced#
| Mode | How |
|---|---|
| Gateway and connector | The gateway checks the lifetime and the idle time on every request, before your application sees it. |
| SDK | The middleware applies the same two values, which it receives in the enforcement feed. |
When a session ends this way the user is sent back to the sign-in page, and returns to where they were after signing in.
Choosing values#
The idle timeout is the one your users will notice. It protects an unattended screen; it does nothing against a stolen session that is in use. Set it for the first case, and rely on session binding and ending sessions for the second.
| Application | Idle | Maximum |
|---|---|---|
| Back-office tool used all day at a desk | 30 minutes | 8 hours |
| Finance, HR, administration | 15 minutes | 4 hours |
| Shared or public machines | 5 minutes | 1 hour |
Something missing or wrong on this page? Tell us and we will fix it.