In my ASP.NET Core MVC app the lifetime of the authentication cookie is set to 'Session', so it lasts until I close the browser. I use the default authentication scheme for MVC:
app.UseIdentity();
How can I extend the lifetime of the cookie?
The ASP.NET Identity middleware which you are using is a wraper around some calls to UseCookieAuthentication
which includes the Cookie Authentication middleware on the pipeline. This can be seen on the source code for the builder extensions of the Identity middleware here on GitHub. In that case the options needed to configure how the underlying Cookie Authentication should work are encapsulated on the IdentityOptions
and configured when setting up dependency injection.
Indeed, looking at the source code I linked to you can see that the following is run when you call app.UseIdentity()
:
var options = app.ApplicationServices.GetRequiredService<IOptions<IdentityOptions>>().Value;
app.UseCookieAuthentication(options.Cookies.ExternalCookie);
app.UseCookieAuthentication(options.Cookies.TwoFactorRememberMeCookie);
app.UseCookieAuthentication(options.Cookies.TwoFactorUserIdCookie);
app.UseCookieAuthentication(options.Cookies.ApplicationCookie);
return app;
To setup the IdentityOptions
class, the AddIdentity<TUser, TRole>
method has one overloaded version which allows to configure the options with one lambda. Thus you just have to pass in a lambda to configure the options. In that case you just access the Cookies
properties of the options class and configure the ApplicationCookie
as desired. To change the time span you do something like
services.AddIdentity<ApplicationUser, IdentityRole>(options => {
options.Cookies.ApplicationCookie.ExpireTimeSpan = TimeSpan.FromHours(1);
});
EDIT: The ExpireTimeSpan
property is only used if when calling HttpContext.Authentication.SignInAsync
we pass in an instance of AuthenticationProperties
with IsPersistent
set to true
.
Trying out just with the Cookie Authentication Middleware it turns out that this works: if we just sign in without this option, we get a cookie that lasts for the session, if we send this together we get a cookie which lasts what we setup when configuring the middleware.
With ASP.NET Identity the way to do is pass the parameter isPersistent
of the PasswordSignInAsync
with value true
. This ends up being a call to SignInAsync
of the HttpContext
passing in the AuthenticationProperties
with the IsPersistent
set to true. The call ends up being something like:
var result = await _signInManager.PasswordSignInAsync(model.Email, model.Password, model.RememberMe, lockoutOnFailure: false);
Where the RememberMe
is what configures if we are setting IsPersistent
to true or false.