I set IdentityTokenLifetime to a very small value as 60 seconds, but after 60 seconds I refresh page and I still remain login, why is that? isn’t that I should be prompted to enter username and password again? My understanding is, IdentityTokenLifetime results an “exp” with the matching value in the id token’s payload, then this value is used to setup the cookie’s expire time. So after 60 seconds, the user-to-relyingParty cookie should expire, then why I am still being able to remain signin?

learn why Relying Party doesn’t honour IdentityTokenLifetime setting