Why doesn't cookie ExpireTimeSpan setting work?

Question

I used:

services.AddAuthenticationCore().ConfigureApplicationCookie(o =>
{
    o.ExpireTimeSpan = TimeSpan.FromHours(1);
    o.SlidingExpiration = true;
});

to set my authentication cookie ExpireTimeSpan in Startup.cs in ASP.NET Core MVC project.

I can see that the cookie expire-time has been set correctly in the web browser after login, but it auto logout after 30 minutes every time, even if I refresh the website every 10 seconds.

If I set the ExpireTimeSpan less than 30 minutes, it can timeout correctly, but expire-time cannot be refreshed.

Why is it 30 minutes? Where can I change the 30 minutes timeout setting? Or is it set in IIS?

Are you calling before or after `IdentityRegistrar.Register(services);`? — aaron, Feb 27 '18 at 16:03
Yes,it is Asp.net Core,and I calling before IdentityRegistrar.Register(services); — Hogan.Wong, Feb 28 '18 at 01:33

aaron · Accepted Answer · 2018-02-28T02:03:53.617

4

Why is it 30 minutes?

It's the default of ASP.NET Core Identity.

Where can I change the 30 minutes timeout setting? Or is it set in IIS?

No. Call ConfigureApplicationCookie after IdentityRegistrar.Register:

public IServiceProvider ConfigureServices(IServiceCollection services)
{
    // ...

    IdentityRegistrar.Register(services);                  // No change
    AuthConfigurer.Configure(services, _appConfiguration); // No change

    services.ConfigureApplicationCookie(o =>
    {
        o.ExpireTimeSpan = TimeSpan.FromHours(1);
        o.SlidingExpiration = true;
    });

    // ...
}

"If you define it before the services.AddIdentity, your custom values will be overwritten."

https://github.com/aspnet/Identity/issues/1389#issuecomment-324257591

edited Feb 28 '18 at 02:03

answered Feb 28 '18 at 01:58

aaron

39,695
6
46
102

Use set options.ValidationInterval solve my problem，I think it maybe didn't pass the validity-check of the cookie。 – Hogan.Wong Feb 28 '18 at 05:04
Sorry for asking here, but I have exactly the same problem in ASP.NET MVC Standard, I can decrease the expire time but I'm not able to increase it, Do you have any idea? – Hooman Limouee Dec 16 '21 at 21:18
this was the only one that worked in identityserver4 +1 – PontiacGTX Oct 06 '22 at 21:05

score 0 · Answer 2 · answered Nov 02 '22 at 16:05

0

I know this is an old post but I'm posting this here because it took me ages to find a solution and this post came up a lot in my searches, see my answer here: https://stackoverflow.com/a/74292208/1540766

answered Nov 02 '22 at 16:05

tappetyclick

472
2
14

Why doesn't cookie ExpireTimeSpan setting work?

2 Answers2

Linked