Ory is the largest open source community in the world for cloud software application security. We maintain advanced open source security software solving authentication, authorization, access control, application network security, and delegation. Ory implements a variety of industry and best-practice standards including OAuth 2.0 / OAuth 2.1, OpenID Connect, Zero Trust Networking, Google Zanzibar Policy Framework, FIDO2 U2F, WebAuthn, TOTP, and more.

Ory Community

image.png

Hi guys, Let me confirm about login and consent challenge expiration time. What is the correct value? 30m or 1h?

The default value is 1h, it apparently has not been updated there, you up for a fix? :slightly_smiling_face:

<@U011D3UQKNY> Anyway, we've got an issue from the tester login_challenge that has expired after 30m. Is it possible for my case to still use the old configuration? What did you mean to fix? updated your document or fix our config?

Update the document.
It seems the documentation is wrong then, if the actual default value is 30 mins.
Anyway you can choose what expiration time works best for you, 30mins-1h is just a recomendation.

Let me confirm. The actual default should be 1h. I will update my config to avoid confusion with my team and the tester. So I am OK to update the documentation. Please share me for how to update it.