Client sessions

import { Render, Badge } from "~/components";

Client sessions control how often users must re-authenticate with your identity provider (IdP) while using the Cloudflare One Client (formerly WARP). Unlike legacy VPNs, which enforce a single global session timeout, Cloudflare One allows you to set session timeouts per application or per policy. You can configure session timeouts for your Access applications or as part of your Gateway policies.

Prerequisites

Ensure that traffic can reach your IdP and <your-team-name>.cloudflareaccess.com through the Cloudflare One Client.

Configure client sessions in Gateway

:::note[Enforce a global timeout]

To enforce a global reauthentication event, set each of your Network or HTTP policies to the same device client session duration. :::

Configure client sessions in Access

You can allow users to log in to Access applications using their device client session. Authenticate with Cloudflare One Client is only supported for Access applications protected by Allow or Block policies.

To configure device client sessions for Access applications:

1. In the Cloudflare dashboard, go to Zero Trust > Access controls > Access settings.
2. Enable Authenticate with Cloudflare One Client.
3. Under Session duration, choose a session timeout value of up to 90 days. This timeout will apply to all Access applications that have Authenticate with Cloudflare One Client enabled.

:::note

This timeout value does not apply to device client session checks in Gateway policies. :::

4. (Optional) To enable Authenticate with Cloudflare One Client by default for all existing and new applications, select Apply to all Access applications. You can override this default setting on a per-application basis when you create or modify an Access application.
5. Select Save.

Users can now authenticate once with the Cloudflare One Client and have access to your Access applications for the configured period of time. The session timer resets when the user re-authenticates with the IdP used to enroll in the Cloudflare One Client.

Force user interaction with IdP

If the user has an active browser session with the IdP, the Cloudflare One Client will use the existing browser cookies to re-authenticate and the user will not be prompted to re-enter their credentials. You can override this behavior to require explicit user interaction in the IdP.

Supported IdPs

• Microsoft Entra ID

Manually reauthenticate

Limitations

• Only one user per device — If a device is already registered with User A, User B will not be able to log in on that device through the re-authentication flow. To switch the device registration to a different user, User A must first log out from Zero Trust (if Allow device to leave organization is enabled), or an admin can revoke the registration from Team & Resources > Devices. User B can then properly enroll.

• Active connections are not terminated — Active sessions such as SSH and RDP will remain connected beyond the timeout limit.

• Binding Cookie is not supported - Authenticate with Cloudflare One Client will not work for Access applications that have the Binding Cookie enabled.

Related resources

• Connectivity status - Learn about the status messages displayed by the Cloudflare One Client during its connection process, and understand each stage as the client establishes a secure tunnel to Cloudflare.