Nginx OpenID_Connect: Default settings lead to max 1 hour session before prompting

[edmorley]

There are three main settings at play:

• lua-resty-openidc's refresh_session_interval (default: not set, example in this repo: 900s)
• lua-resty-openidc's access_token_expires_in (default: 3600s, example in this repo: 3600s)
• lua-resty-session's session_cookie_lifetime (default: 3600s, example in this repo: not set)

There are a few problems with these:

1. refresh_session_interval doesn't actually do what it implies / perhaps should be doing something else entirely (see discussion in Clarify documentation around refresh_session_interval vs access_token_expires_in zmartzone/lua-resty-openidc#66).
2. the 1 hour default cookie lifetime means that the user will get re-prompted on Auth0 after all, since lua-resty-openidc will treat them as a new user, rather than giving them the prompt=none experience as promised.

For OrangeFactor I've increased the cookie lifetime to 2 weeks using set $session_cookie_lifetime '1209600'; in the nginx configs.