title: Handle token timeout in Asp.Net MVC when using Azure AD
body: <p>This is more of a design/approach question...</p>
  
  <p>I think I'm missing something here. We're building an Asp.Net MVC 5 web application and securing it with Azure AD using the following scenario:</p>
  
  <p><a href="https://azure.microsoft.com/en-us/documentation/articles/active-directory-authentication-scenarios/#web-browser-to-web-application" rel="nofollow noreferrer">https://azure.microsoft.com/en-us/documentation/articles/active-directory-authentication-scenarios/#web-browser-to-web-application</a></p>
  
  <p><a href="https://github.com/Azure-Samples/active-directory-dotnet-webapp-openidconnect" rel="nofollow noreferrer">https://github.com/Azure-Samples/active-directory-dotnet-webapp-openidconnect</a></p>
  
  <p>The token/cookie is an absolute expiry and expires after one hour.  So what does that do for the user experience?  Every hour they have to log back in no matter what?  In our testing, when the user expires, the browser is redirected back to AD and the user prompted for credentials.  This, of course, breaks any AJAX calls we have loading partial views and none of our DevExpress controls are stable as a result.</p>
  
  <p>Based on the response to this SO post:  <a href="https://stackoverflow.com/questions/32428929/mvc-ad-azure-refresh-token-via-adal-javascript-ajax-and-knockoutjs">MVC AD Azure Refresh Token via ADAL JavaScript Ajax and KnockoutJs</a></p>
  
  <p>...what I'm seeing is expected?  It seems to me like not a very viable solution for a cloud hosted line-of-business application where users are logged in and working all day.</p>
  
  <p>Am I missing something? Or is this just not an ideal scenario for business apps?</p>