People were seeing a “Session expiring” message, clicking “Stay logged in”, and being logged out anyway. Nothing was crashing. Two sensible settings simply didn’t agree with each other.
The two clocks
Most web applications that use an identity server have two lifetimes running at once. The access token proves who you are on each request, and ours lasts an hour. The sign-in session lives on the identity server and keeps the refresh token valid. Keycloak’s default ends that session after 30 minutes if nothing has renewed it.
Our app renewed five minutes before the access token ended, at minute 55. That looks careful, but by then the session could have been gone for 25 minutes. The renewal failed, so the dialog appeared, and the button tried the same renewal that had just failed.
If your renewal runs later than your idle limit, it only works for people whose session something else has kept alive.
What we changed
- Renew inside the idle limit. The app now renews every 20 minutes, well within the default 30.
- Don’t disturb the page. Our first fix replaced the tokens every time, and open pages reloaded their data on each change. Now a renewal usually just keeps the session alive. The tokens are replaced only in their last 25 minutes, about every 40 minutes.
- Read the lifetime from the token. We used to assume an hour from a settings value. Now the app reads the token’s own issue and expiry times, and counts from when it arrived, so a wrong clock on someone’s device can’t end their session early.
- Tell the two failures apart. A network problem is worth retrying, so the app retries quietly each minute. A refusal means the sign-in is over, so retrying is pointless, and the dialog says so plainly.
- Try before logging out. Reloading the page just after the token ended used to log you out at once, even if the session was still alive. Now it tries one renewal first.
Show people the time
The dialog now counts down, and only appears in the last five minutes, after renewal has really failed. A countdown tells someone whether to finish a sentence or save right now. “About to expire” doesn’t.
How to check your own application
- Write down your access token lifetime and your identity server’s idle and maximum session limits, side by side.
- Check when your app actually renews. It should be well inside the idle limit, not just before the token ends.
- Leave a tab open and untouched for longer than the idle limit, then use it. That’s the test most teams skip.
- Remember the maximum session limit, which is 10 hours by default in Keycloak. Renewal can’t get past it, so people will need to sign in again.
The trade-off
Renewing regardless of activity means an unattended tab stays signed in until the maximum session limit. That suits most business tools, but not every one. If yours handles sensitive work on shared computers, you may want renewal to depend on recent activity instead.