How to set asp.net Identity cookies expires time
In order to achieve the feature you are describing in ASP.NET Core 3.1, I configure authentication in Startup
in the following way:
services.ConfigureApplicationCookie(o =>
{
...
o.ExpireTimeSpan = TimeSpan.FromMinutes(30);
o.SlidingExpiration = true;
...
o.Events.OnSigningIn = ctx =>
{
if (ctx.Properties.IsPersistent)
{
var issued = ctx.Properties.IssuedUtc ?? DateTimeOffset.UtcNow;
ctx.Properties.ExpiresUtc = issued.AddDays(14);
}
return Task.FromResult(0);
};
});
Using the OnSigningIn
callback, I explicitly set the expiration date to now + 14 days if the "isPersistent" check-box is clicked.
Use this...
public void ConfigureAuth(IAppBuilder app)
{
app.UseCookieAuthentication(new CookieAuthenticationOptions
{
ExpireTimeSpan = TimeSpan.FromHours(1),
});
}
If IsPersistent
property of AuthenticationProperties
is set to false, then the cookie expiration time is set to Session.
If checkbox "remember me" is checked then AuthenticationManager.SignIn(new AuthenticationProperties{ IsPersistent = true }, userIdentity);
will create a cookie with expiration time equal to ExpireTimeSpan
you set up in Startup.cs
(defaults to 14days).
If checkbox "remember me" is NOT checked then you have to use AuthenticationManager.SignIn(new AuthenticationProperties{ IsPersistent = true, ExpiresUtc = DateTimeOffset.UtcNow.AddMinutes(30)}, userIdentity);
. Again IsPersistent
is set to true but now we give a value to ExpiresUtc so it does not use from CookieAuthenticationOptions
from Startup.cs
.
public override async Task SignInAsync(ApplicationUser user, bool isPersistent, bool rememberBrowser)
{
var userIdentity = await CreateUserIdentityAsync(user).WithCurrentCulture();
// Clear any partial cookies from external or two factor partial sign ins
AuthenticationManager.SignOut(DefaultAuthenticationTypes.ExternalCookie, DefaultAuthenticationTypes.TwoFactorCookie);
if (rememberBrowser)
{
var rememberBrowserIdentity = AuthenticationManager.CreateTwoFactorRememberBrowserIdentity(ConvertIdToString(user.Id));
AuthenticationManager.SignIn(new AuthenticationProperties { IsPersistent = isPersistent }, userIdentity, rememberBrowserIdentity);
}
else
{
//AuthenticationManager.SignIn(new AuthenticationProperties { IsPersistent = isPersistent }, userIdentity);
if (isPersistent)
{
AuthenticationManager.SignIn(new AuthenticationProperties { IsPersistent = true }, userIdentity);
}
else
{
AuthenticationManager.SignIn(new AuthenticationProperties { IsPersistent = true, ExpiresUtc = DateTimeOffset.UtcNow.AddMinutes(30) }, userIdentity);
}
}
}