Geek Answers Handbook

ASP.Net 5 Authentication with Retained Authentication IIS 7.5 Idle Timer Does Not Work

I had a problem with the "remember me" checkbox in the MVC6 project. I had a question here that solved the problem for debugging my local host, however, after deploying the project in our dev environment, it still forces me to re-login after 20 minutes.

The 20 minute time span made me think that something was incorrectly configured using IIS. I found that my application pool (configured as "no managed code") the idle timer is idle after 1 minute. Of course, after 1 minute I need to log in again.

This leads me to believe that my saved cookie authenticator is no longer accepted as valid after reusing the application pool (although my cookie is configured so that it does not expire before 10 days, and SecurityStampValidationInterval set to 10 days and 1 min.

I saw something similar in early versions of .NET related to the web.config machine key, but MVC6 does not have a system.web section in the web.config file so that I can put the machine key.

My .NET project. DNX targets the full .NET platform, not the .NET Core.

+8
c # asp.net-core asp.net-core-mvc
source share
2 answers

How did you set up data protection? With IIS and DNX, we don’t know where to store keys permanently unless you upload a profile that is not the default. Therefore, as soon as your application completes all the keys used to sign authentication cookies, it is discarded. This does not happen in IIS Express because IIS Express loads profiles.

You have a couple of options. You can run the provisioning script on the IIS server to create some registry entries that ASP.NET can use, or you can configure data protection to use the file system , which would be if you wanted to run multiple hosts.

+6
source share

EDIT

See @blowdart answer for a better solution.

For those who are facing the same problem as me, the “fix” I performed for this is to set the Idle timer in IIS to 0, which means no timeout.

I'm still trying to find a real solution, as some hosting environments may not set the idle timer to 0 (usually this is shared hosting, etc.).

+1
source share

More articles:


All Articles