ASP.NET Core 2.0 - users are logged out within an hour

Question

Some days ago i published my code into a "production" environment just for testing purposes. So this website i've been developing it's online. The issue is that no matter what changes i do to the cookie settings.

I tried changing the sliding expiration to true and to false, both using:

        options.ExpireTimeSpan = TimeSpan.FromDays(30);                
        options.Cookie.Expiration = TimeSpan.FromDays(30);

Also setting the expiration to 1 year. Nothing seems to be working.

This is my setup from Startup.cs:

public void ConfigureServices(IServiceCollection services)
        {
            services.Configure<ForwardedHeadersOptions>(options =>
            {
                options.ForwardedHeaders = ForwardedHeaders.All;
                options.RequireHeaderSymmetry = false;
            });

            services.AddDbContext<IdentityDataContext>();

            services.AddIdentity<PinchilaIdentityUser, IdentityRole>()
                .AddEntityFrameworkStores<IdentityDataContext>()
                .AddUserManager<PinchilaUserManager>()
                .AddDefaultTokenProviders();
                services.Configure<SecurityStampValidatorOptions>(options => options.ValidationInterval = TimeSpan.FromSeconds(10));
                services.AddAuthentication()
                    .Services.ConfigureApplicationCookie(options =>
                    {
                        options.SlidingExpiration = true;
                        options.ExpireTimeSpan = TimeSpan.FromMinutes(30);
                    });
}

        //COOKIE
            services.ConfigureApplicationCookie(options => {
                if (!String.IsNullOrEmpty(PinchilaSettings.Instance.CookieDomain))
                {
                    options.Cookie.Domain = PinchilaSettings.Instance.CookieDomain;
                }
                if (!String.IsNullOrEmpty(PinchilaSettings.Instance.CookieName))
                {
                    options.Cookie.Name = PinchilaSettings.Instance.CookieName;
                }
                options.AccessDeniedPath = new PathString("/error/default");
                options.ExpireTimeSpan = TimeSpan.FromDays(30);
                options.Cookie.Expiration = TimeSpan.FromDays(30);
            });

            var mvcBuilder = services.AddMvc();

            services.Configure<RazorViewEngineOptions>(options => {
                options.ViewLocationExpanders.Add(new ViewLocationExpander());
            });

            mvcBuilder.AddMvcOptions(o => {
                o.Filters.Add(typeof(GlobalExceptionFilter));
                o.Filters.Add(typeof(RuntimeStateFilter));
                o.Filters.Add(typeof(RouteLoggerFilter));
            });

            services.AddAntiforgery(options => {
                options.HeaderName = Utilities.CONSTANTS.REQUEST_VERIFICATION_HEADER_NAME;
                options.FormFieldName = Utilities.CONSTANTS.REQUEST_VERIFICATION_HEADER_NAME;
            });


            services.AddScoped<IViewRenderService, ViewRenderService>();
            services.AddLogging(loggingBuilder =>
            {
                var filter = new LoggingFilter();
                loggingBuilder.AddFilter(filter.Filter);
            });
        }

And this is my login part from my AccountController:

[HttpPost]
[AllowAnonymous]
[PinchilaValidateAntiForgeryToken]
public async Task<ActionResult> Login(LoginViewModel model, string returnUrl)
{
    ViewData["ReturnUrl"] = returnUrl;
    if (ModelState.IsValid)
    {
        model.UserName = model.UserName.TrimSafe();
        model.Password = model.Password.TrimSafe();
        var user = await _userManager.FindByNameAsync(model.UserName);
        if (user != null)
        {
            var result = await _signInManager.PasswordSignInAsync(user, model.Password, model.RememberMe, lockoutOnFailure: true);
            if (result.Succeeded)
            {

                var cookie = HttpContext.Request.Cookies["theme"];
                if (cookie != null && !String.IsNullOrEmpty(cookie))
                {
                    Response.Cookies.Append("theme", "", new Microsoft.AspNetCore.Http.CookieOptions() { Expires = DateTime.UtcNow.AddDays(30) });
                }

                return RedirectToLocal(returnUrl);
            }
            if (result.IsLockedOut)
            {
                ModelState.AddModelError(string.Empty, "This account has been locked out for security reasons. Try again later.");
                return View(model);
            }
            else
            {
                ModelState.AddModelError(string.Empty, "Invalid login attempt");
                return View(model);
            }
        }
        else
        {
            ModelState.AddModelError(string.Empty, "Invalid login attempt");
        }
    }

    return View(model);

}

If any of you can give me some different point of view i'll be very grateful.

Edit: this is how the cookies looks like on the Chrome console:

Answer 1

Thanks to @TiagoBrenck comment i started looking for an answer on the server side.

I found out this post. Please look at the @dantey89 answer. It fixed my issue.

Basically, inside startup.cs, on ConfigureServices method you need to put this:

        public void ConfigureServices(IServiceCollection services)
    {

        var environment = services.BuildServiceProvider().GetRequiredService<IHostingEnvironment>();


        services.AddDataProtection()
                .SetApplicationName($"my-app-{environment.EnvironmentName}")
                .PersistKeysToFileSystem(new DirectoryInfo($@"{environment.ContentRootPath}\keys"));

       ...

    }

This will create a folder. It needs permissions from the app pool or will have error 500.

Hope this help others.