Mismatch in Azure B2C Token Expiry with Configured Session Lifetime in API Management

Question

I have B2C integrated with my Azure API Management service for authorization. I've been trying to adjust the session behavior in my user flow, setting the Web app session lifetime (minutes) to 15 minutes. In the token lifetime, I've also set the Access & ID token lifetimes (minutes) to 15. However, when I inspect the page and look at the token's headers, I see that the Set-Cookie header for the token states that it's going to expire in a hour. Why is this issue arising?

I've done some research into the issue, and found this post about this issue: https://stackoverflow.com/questions/58835708/changing-azure-ad-b2c-access-token-lifetime-doesnt-work They are encountering the same issue as me, however it hasn't been updated - I was wondering if this issue may have already been fixed as it was an issue back in 2019.

Answer 1

Hi @hawthorne91

Sorry for the delay in response.

I have tested your scenario, and I have seen the token lifetime is same as configured in Azure AD B2C

Could you please check by try to Configure token lifetime and Request an access token and decode the token by using https://jwt.ms and check the token exp to know the expiration and is it is same as configured.

Hope this helps. Do let us know if you any further queries by responding in the comments section.

Thanks,

Akhilesh.

---

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.