# Force OAuth2 re-authentication after N days?

**URL:** <https://meta.discourse.org/t/force-oauth2-re-authentication-after-n-days/44058>\
**Category:** Product Support\
**Created:** [May 11, 2016, 4:40pm UTC](https://meta.discourse.org/t/force-oauth2-re-authentication-after-n-days/44058 "2016-05-11T16:40:51Z")\
**Posts on this page:** 1\
**Showing post:** 8

<div class="post-metadata">

**Author:** ![aviflax](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/aviflax/32/102191_2.png) [@aviflax](https://meta.discourse.org/u/aviflax)\
**Post date:** [May 11, 2016, 7:22pm UTC](https://meta.discourse.org/t/force-oauth2-re-authentication-after-n-days/44058/8 "2016-05-11T19:22:21Z")

</div>

Ah, I see — thanks for clarifying!

An alternative approach that should work on all browsers and might be less annoying for users would be to keep track of the last time a user logged in, and on every page access compute how long ago that was, and if it’s greater than N {days,hours}, then force them to re-authenticate.

And of course N should be configurable; security and user annoyance would both have an inverse relationship to the size of the value.

Google does this with my Google Apps accounts (with 2FA enabled) — they force me to re-authenticate once a month, but it’s pretty smooth.

---

_[View the full topic](https://meta.discourse.org/t/force-oauth2-re-authentication-after-n-days/44058)._