title: ADAL JS Forced Logout in SPA
body: <p>I have written a SPA written in Angular, and am using Azure AD token based authentication, with Resources (like APIs) that are secured through bearer tokens. This allows the SPA to retrieve renewal tokens from Azure and continually stay logged in, as far as I know, forever. </p>
  
  <p>I am using the ADAL JavaScript library for Angular to do this:</p>
  
  <p><a href="https://github.com/AzureAD/azure-activedirectory-library-for-js" rel="nofollow noreferrer">https://github.com/AzureAD/azure-activedirectory-library-for-js</a> </p>
  
  <p>Now there is a requirement to limit the users session to predetermined amount of time, lets say 15 hours. </p>
  
  <p>I wrote a nice little service which stores a cookie upon login, every request it checks the date in the cookie and if they have exceeded their maximum session limit. This works fine if the user is continually uses the app, or closes the browser - but if they leave their browser open, the token will simply renew in the background and they remain logged in.</p>
  
  <p>I am now trying to solve this using a silent sign out solution. Meaning, I would like the user to be forced to the Secure Sign in Page once their session has expired.</p>
  
  <p>This seems like it would be a common scenario, but I can not seem to figure out how to achieve it, as ADAL uses an iFrame in the background. I thought about using a timer/interval, but that seems hokey. </p>
  
  <p>Just FYI I am using the adalAuthenticationService.logout() per my below code sample. I have also tried clearing the session cache, which works - but ADAL will silently refresh the token. I also tried setting the redirectUri location to a non authenticated page, but still, it will only redirect there if the user takes action. If the browser simply remains open, the token will just reset itself. </p>
  
  <pre><code>    var maxTime = 15; // hours allowed in session
  
      // event to fire check; maybe this can be different, and is my problem?
      $rootScope.$on('$viewContentLoaded', function () {
          $scope.checkLogoutCookie();
      });
      $scope.logout = function() {
          adalAuthenticationService.logout();
      };
      function setCookie(c) {} // implementation details don't matter....
      function getCookie(c) {} // implementation details don't matter....
      $scope.checkLogoutCookie = function () {
          var lastLogin = getCookie("lastLogin");
          var loginDate = new Date();
          if (lastLogin === "") { // is empty
              setCookie("lastLogin", loginDate, 365);
          } else {
              var lastDate = new Date(lastLogin);
              var hours = Math.abs(lastDate - loginDate) / 36e5;
              if (hours &gt; maxTime) {
                  setCookie("lastLogin", "", 0);
                  $scope.logout();
              }
          }
      }
  </code></pre>