OIDC session expires with ID token expiry and refresh token is never used.

server/auth/types/openid/openid_auth.test.ts

@@ -236,7 +236,8 @@ describe('test OpenId authHeaderValue', () => {
       authType: 'openid',
     };
 
-    expect(await openIdAuthentication.isValidCookie(testCookie, {})).toBe(true);
+    // As ID token is expired and no refresh token value is passed, it will return false
+    expect(await openIdAuthentication.isValidCookie(testCookie, {})).toBe(false);
     global.Date.now = realDateNow;
   });
 

server/auth/types/openid/openid_auth.ts

@@ -272,7 +272,7 @@ export class OpenIdAuthentication extends AuthenticationType {
       return false;
     }
 
-    if (cookie.expiryTime > Date.now()) {
+    if (cookie.credentials.expiryTime > Date.now()) {
       return true;
     }
 
@@ -296,8 +296,9 @@ export class OpenIdAuthentication extends AuthenticationType {
           cookie.credentials = {
             authHeaderValueExtra: true,
             refresh_token: refreshTokenResponse.refreshToken,
+            expiryTime: getExpirationDate(refreshTokenResponse),
           };
-          cookie.expiryTime = getExpirationDate(refreshTokenResponse);
+          cookie.expiryTime = Date.now() + this.config.session.ttl;
 
           setExtraAuthStorage(
             request,

server/auth/types/openid/routes.ts

@@ -195,9 +195,10 @@ export class OpenIdAuthRoutes {
             username: user.username,
             credentials: {
               authHeaderValueExtra: true,
+              expiryTime: getExpirationDate(tokenResponse),
             },
             authType: AuthType.OPEN_ID,
-            expiryTime: getExpirationDate(tokenResponse),
+            expiryTime: Date.now() + this.config.session.ttl,
           };
           if (this.config.openid?.refresh_tokens && tokenResponse.refreshToken) {
             Object.assign(sessionStorage.credentials, {