Login session duration can be extended from 8 hours
- Dominant language
- No language data
- Stars
- 346
- Forks
- 67
- PR merge metrics
- No merged PRs in 30d
Description
**Is your feature request related to a problem? Please describe.**
When using Static Web App custom authentication, the login session (actually a cookie) expires in 8 hours and cannot be extended using `/.auth/refresh` like the App Service, so I would like to extend the expiration time from 8 hours.

Once issued, the `StaticWebAppsAuthCookie` cookie expiration date is not extended and API calls will not work properly once it expires.
In particular, using `responseOverrides` to convert HTTP 401 to HTTP 302 redirects, as described in the following document, leads to CORS errors and makes error handling in the application difficult.
https://docs.microsoft.com/en-us/azure/static-web-apps/configuration#response-overrides

Since SPAs often do not reload entire pages for long periods of time, expiring login sessions in the middle of a page can cause unexpected behavior.
**Describe the solution you'd like**
I would like to be able to change the cookie validity time for custom authentication using `staticwebapp.config.json`. Or, allow session extension using `/.auth/refresh`.
Ideally, the login session would be automatically extended on a sliding when the time remaining in the session becomes too short.
**Describe alternatives you've considered**
None
**Additional context**
In the case of SPA, only the API response status code can determine cookie expiration, so if you are using `responseOverrides` to redirect HTTP `401` to HTTP `302` as in the sample in the official documentation, error handling becomes very difficult.
- Related Issue
- #762
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.