title: Token bearer authentication - logout after inactivity time
body: <p>I am writing knockout application with Wep Api as a backend. I used this <a href="http://bitoftech.net/2014/06/01/token-based-authentication-asp-net-web-api-2-owin-asp-net-identity/" rel="nofollow noreferrer">tutorial</a> to implement token bearer authorization, so I have access tokens, however login functionality is provided externally.
  What I need to implement is logging out after certain time, e.g. 1 hour, and if all time active - after longer time - 10 hours. So I have my settings like below:</p>
  
  <pre><code>   OAuthAuthorizationServerOptions OAuthServerOptions = new OAuthAuthorizationServerOptions()
          {
              AllowInsecureHttp = true,
              TokenEndpointPath = new PathString("/token"),
              AccessTokenExpireTimeSpan = TimeSpan.FromHours(10),     
              Provider = container.Resolve&lt;IOAuthAuthorizationServerProvider&gt;()
          };
  </code></pre>
  
  <p>And it works - access is being revoked after 10 hours, but how to achieve logging out after being inactive for 1 hour? I am wondering about certain usage of refresh tokens or implementing sessions into the app.</p>