Auth0 Session Management — Managing Authentication Sessions with Auth0

// Session configuration
const tenantSettings = await auth0.tenants.updateSettings({
  session: {
    lifetime: 3600,           // 1 hour default session
    inactivity_timeout: 600,  // 10 min inactivity
    remember_within: 2592000  // 30 days remember me
  }
});

// Application session settings
const client = await auth0.clients.update(
  { client_id: 'app_client_id' },
  {
    token_endpoint_auth_method: 'client_secret_post',
    jwt_configuration: {
      lifetime_in_seconds: 7200,
      secret_encoded: false
    },
    sso: {
      enabled: false,
      sessions_per_user: 1  // Limit concurrent sessions
    }
  }
);

// Revoke all sessions for a user
async function revokeAllSessions(userId) {
  await auth0.users.invalidateSessions({ id: userId });
}

// Post-login session handling
exports.onExecutePostLogin = async (event, api) => {
  const currentSessions = event.user.app_metadata?.active_sessions || [];
  if (currentSessions.length >= 3) {
    await api.user.setAppMetadata('oldest_session', currentSessions.shift());
  }
  await api.user.setAppMetadata('active_sessions', [
    ...currentSessions,
    event.request.session_id
  ]);
};