CookieAuthenticationOptions, ExpireTimeSpan does not work

Question

I have the following code:

    public void ConfigureAuth(IAppBuilder app)
    {
        app.UseCookieAuthentication(new CookieAuthenticationOptions
        {
            AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
            ExpireTimeSpan = System.TimeSpan.FromMinutes(1),
            LoginPath = new PathString("/Account/Login"),
            LogoutPath = new PathString("/Account/LogOff")
        });

But login session active more than 1 minute. Also, LogoutPath is not called when time is expired. Why?

score 35 · Accepted Answer · edited Oct 22 '14 at 13:52

35

It does expire.

Make sure you do not have any background ajax activity as it extends the session (SlidingExpiration is true by default).

Also I had to manually delete the old cookie after I changed ExpireTimeSpan from the default 14 days to a smaller value.

edited Oct 22 '14 at 13:52

Peter Majeed

5,304
2
32
57

answered Nov 28 '13 at 07:08

Adas Petrovas

575
5
7

Deleting the cookies is what did it. – bojingo May 14 '14 at 13:00
@Adas Petrovas where did you find these defaults, please? – Jordan Morris Sep 11 '14 at 00:08
1

I found it in the Katana source code. See line 24: [CookieAuthenticationOptions.cs](https://katanaproject.codeplex.com/SourceControl/latest#src/Microsoft.Owin.Security.Cookies/CookieAuthenticationOptions.cs) – Adas Petrovas Sep 12 '14 at 14:26
4

Note that thought the cookie itself is set to session expiration (expires only on browser closure), the expiration information is in the protected ticket itself (inside the cookie), thus the ticket could expire if the ExpireTimeSpan has passed, though the cookie didn't expire. – RonyK Oct 06 '14 at 15:26
2

@RonyK Could you elaborate on this please? When I view the cookie info in Chrome console, it always tells me `Expires: Session`, regardless of whatever value I set in `ExpireTimeSpan`. Basically I want the cookie to stick around and not expire on session. – GFoley83 Nov 25 '14 at 21:08
12

Nevermind, I realised you have to also set `IsPersistent = true` when signing in: `context.OwinContext.Authentication.SignIn(new AuthenticationProperties() { IsPersistent = true }, cookieIdentity);`. – GFoley83 Nov 25 '14 at 21:32

score 10 · Answer 2 · answered Mar 27 '19 at 10:02

You must set IsPersistent to true otherwise you don't run code

    ClaimsIdentity claimsIdentity = new ClaimsIdentity(Claims, CookieAuthenticationDefaults.AuthenticationScheme);

                var authProperties = new AuthenticationProperties
                {
                    IsPersistent = true

                };

                await HttpContext.SignInAsync(CookieAuthenticationDefaults.AuthenticationScheme, new ClaimsPrincipal(claimsIdentity), authProperties);

score 0 · Answer 3 · answered Nov 02 '22 at 16:01

I'm posting this here because it took me ages to find and this post comes up every time I searched for the problem, so hopefully this helps someone else

I was using .NET framework 4.8 and OWIN, so my sign in function call looked like:

public virtual Task SignInAsync(
    TUser user,
    bool isPersistent,
    bool rememberBrowser
)

see: https://learn.microsoft.com/en-us/previous-versions/aspnet/mt173757(v=vs.108)

I wasn't using the built in 2FA but was still setting rememberBrowser = true and no matter what I did the ExpireTimeSpan was ignored and it used the default of +14 days.

Once I set rememberBrowser = false everything worked as expected

I hope this saves someone else the entire day of googling and randomly changing stuff this cost me!

CookieAuthenticationOptions, ExpireTimeSpan does not work

3 Answers3

Linked