title: How to handle idle session timeout across client apps and Identityserver4
body: <p>I got stuck and need some advice or pointer to a solution. I have a fairly simple IdentityServer4 setup for our single sign on Implementation. </p>
  
  <p>Three Apps</p>
  
  <p>IdentityServer4 with asp.net core identity (ID server)</p>
  
  <p>ASP.NET Core 2.2 MVC (client1)</p>
  
  <p>ASP.NET Core 2.2 MVC (client2)
  The MVC client is setup using Hybrid Grant</p>
  
  <p>Two scenarios:</p>
  
  <ol>
  <li>If user is active in any one of the clients(example is client1) then user should not be logged out in client2 after reaching idle timeout in that app(client2).</li>
  <li>If user is inactive in both the clients(client1 and client2) then System should log out user from all the clients(client1 and client2) when idle timeout exceeds.</li>
  </ol>
  
  <p>Scenario 1: User active in any one of the clients.
  User active in client1 and idle in client2
  Expected behavior:
  System should not log out from client2 when idle timeout exceeds. 
  Current Identity Behavior:
  Able to continue works in client1, but client2 and ID server navigates to login page after idle time exceed. </p>
  
  <p>Scenario 2:
  User is inactive in all 2 clients (client1 and client2)
  Expected behavior:
  System should log out user from the all 2 clients and ID server when idle timeout exceeds.</p>
  
  <p>If I set cookie expire time in ID server only (removed slidingexpiration is true and cookie expire time in both client1 and client2) then the client apps are working continuously without expire time even though both the clients are idle until ID server expire time exceeds, client apps are working continuously.</p>
  
  <p>I would like to know if expected behavior can be achieved</p>
  
  <p>Clients:</p>
  
  <pre><code> .AddCookie(options =&gt;
                  {
                      // Configure the client application to use sliding sessions
                      options.SlidingExpiration = true;
                      // Expire the session of 15 minutes of inactivity
                      options.ExpireTimeSpan = TimeSpan.FromMinutes(15);
                  })
  </code></pre>
  
  <p>ID server:</p>
  
  <pre><code>services.AddIdentityServer(options =&gt;
              {
                  options.Authentication.CookieLifetime = TimeSpan.FromMinutes(15);
                  options.Authentication.CookieSlidingExpiration = true;
              })
  </code></pre>