Sessions
Absolute session timeout
The maximum lifetime of a session regardless of activity, after which the user must authenticate again.
What Absolute session timeout means
An absolute session timeout ends a session a fixed time after it began, however active it has been. It complements the idle timeout: the idle timeout ends abandoned sessions, the absolute timeout ends sessions that are kept busy — including by an attacker who has stolen one.
Defined in: NIST SP 800-63B; OWASP Session Management Cheat Sheet.
How it works
NIST SP 800-63B sets reauthentication limits by assurance level, combining an overall limit with an inactivity limit. OWASP recommends both timeouts be enforced on the server, not by a client-side timer.
Refresh tokens need the same idea: a token family that can be rotated forever has no absolute lifetime at all.
The mistake people actually make
Implementing a sliding expiry and calling it an absolute timeout. If each request extends the deadline, there is no absolute limit.
In Authreads
How this applies here
Idle and absolute session expiry are Available and configurable per tenant.
Every capability is listed on /roadmap as Available, In progress or Planned. Nothing is described as available here that is not listed as Available there.
Guides that go deeper
Related terms
Idle timeout and absolute expiry
Two different session limits: one measured from last activity, one from sign-in.
Session revocation
Ending an active session so that subsequent requests fail, rather than waiting for a token to expire.
Refresh token
A long-lived credential used to obtain new access tokens without the user re-authenticating.
Building on any of this?
Tell us what you're putting together. We'll tell you plainly whether Authreads fits it.