I'm trying to use identity with cookie authentication in an asp.netcore 2.0 MVC app. I want to set session timeout to something like 150 days, so users that log in don't need to log in again during a big period of time. I set options.ExpireTimeSpan = TimeSpan.FromDays(150);
but sessions are closed after a few minutes, even if the user is actively using the app.
I'm following the official docs and I have this on my Startup.cs:
Within ConfigureServices
method:
services.AddIdentity<User, Role>()
.AddDefaultTokenProviders();
// Identity Services
services.AddTransient<IUserStore<User>, UserService>();
services.AddTransient<IRoleStore<Role>, RoleService>();
services.Configure<IdentityOptions>(options =>
{
// Password settings
options.Password.RequireDigit = false;
options.Password.RequiredLength = 8;
options.Password.RequireNonAlphanumeric = false;
options.Password.RequireUppercase = false;
options.Password.RequireLowercase = false;
options.Password.RequiredUniqueChars = 3;
// Lockout settings
options.Lockout.DefaultLockoutTimeSpan = TimeSpan.FromMinutes(30);
options.Lockout.MaxFailedAccessAttempts = 10;
options.Lockout.AllowedForNewUsers = true;
// User settings
options.User.RequireUniqueEmail = true;
});
services.ConfigureApplicationCookie(options =>
{
// Cookie settings
options.Cookie.HttpOnly = true;
options.ExpireTimeSpan = TimeSpan.FromDays(150);
options.LoginPath = "/User/Login";
options.LogoutPath = "/User/Logout";
options.AccessDeniedPath = "/User/AccessDenied";
options.SlidingExpiration = true;
});
services.AddMvc(config =>
{
var policy = new AuthorizationPolicyBuilder()
.RequireAuthenticatedUser()
.Build();
config.Filters.Add(new AuthorizeFilter(policy));
});
In the Configure
method I call app.UseAuthentication();
And to do the login, I do:
var result = await _signInManager.PasswordSignInAsync(email, password, isPersistent: true, lockoutOnFailure: false);
Am I missing any config? I theory I'm setting expiry time to 150 days.
Thanks in advance.
EDIT:* It looks like the problem is the ValidationInterval. I found this issue: https://github.com/aspnet/Identity/issues/1513
I tried setting the ValidationInterval to a large value and now sessions are not closed and users are not logged out unexpectedly. This is the code to set the interval:
services.Configure<SecurityStampValidatorOptions>(options =>
options.ValidationInterval = TimeSpan.FromDays(150));
I guess I'll have to see how the security stamp validator works and define the validation interval properly, so sessions are not unexpectedly closed but also, a modification in a user's privileges is not ignored due to a stale cookie.