ASP.Net ID not saved cookie MVC6 vNext

Question

I am working on a MVC6 ASP.Net5 project, and I am having problems with .Net Identity, which saves my cookie for verification at login.

I use custom storage, this is an existing database with existing stored procedures, etc.

My SignIn method is an extension of my User object and follows.

public static async Task SignIn(this UserModel Model, UserManager<UserModel> UserManager, SignInManager<UserModel> SignInManager, bool RemeberMe = true) { var Claims = new List<Claim>(); Claims.Add(new Claim("UserID", Model.UserID.ToString())); Claims.Add(new Claim("Username", Model.Username)); await UserManager.AddClaimsAsync(Model, Claims); await SignInManager.SignInAsync(Model, new AuthenticationProperties { IsPersistent = RemeberMe, AllowRefresh = true }); } 

This works and a cookie is added with an expiration date in the future.

The problem I am facing is that even if the Identity cookie is set for a long time to come, after 20 minutes of inactivity, I have to re-enter the system. It makes me think something is timing, but I'm very new to Identity, and not sure what I'm doing wrong (or really even where to start).

EDIT : this is my custom GetSecurityStampAsync in user repository. I know that it is not safe or even really doing something at the moment, but I'm just trying to figure out what the problem is right now. I plan to reorganize it later when it works.

 public Task<string> GetSecurityStampAsync(UserModel user, CancellationToken cancellationToken) { return Task.FromResult(user.UserID.ToString() + user.Username); } 

Answer 1

Make sure you set the timeouts according to your [s] requirements. Identity 2.1 has two timeout configurations ( ExpireTimespan and ValidateInterval ) that can affect how long a user can log in. You can customize them using:

 app.UseCookieAuthentication(new CookieAuthenticationOptions { Provider = new CookieAuthenticationProvider { OnValidateIdentity = SecurityStampValidator.OnValidateIdentity<ApplicationUserManager, ApplicationUser>( validateInterval: TimeSpan.FromMinutes(15) }, ExpireTimeSpan = TimeSpan.FromMinutes(30) }); 

This is explained in more detail in this article - a bit dated, but should still apply to the most recent version of the ASP.NET kernel that was released at this time of writing (rc1).

If you are using a session, it could also be that you are simply disconnected or cleared.

By default, you get a cache in memory. Once the process is restarted, you will lose your session objects. You need to use persistent storage for your session objects.

If you are using SQL Server, here's an article to get started.