In SSO for Memberships, I’ve discovered that once a user has successfully authenticated to HubSpot via SSO, then their browser contains the “__hsmem” cookie that remains valid for 7 days, regardless of the browser’s login state at the SSO IdP.
For example, the SSO IdP may log the user out after 24 hours of inactivity, or the user may explicitly log themselves out at the IdP. However, if the user opens some private content URL within the 7 days period, then HubSpot will happily serve the content to the browser as if the user were still logged in.
I’ve noticed that HubSpot supports an Inactivity Timeout, but in testing, this appears to be implement through JavaScript on the CMS page, so it only executes if the user has a CMS page still open in their browser and has not moved their cursor. My limited testing revealed that a 15 minute inactivity timeout was *not* enforced by the server itself -- I was able to continue to use curl with the __hsmem cookie to fetch a private content page every 20 minutes for several hours after I had closed any other page on the domain.
Are there any other possibilities for ensuring that HubSpot member login will honor the SSO login state after some period of time less than 7 days?