ASP .NET Core Cookie Authentication expiration changes from timestamp to "Session" upon return

Question

I am using ASP .NET Core RC1 with Facebook-authentication and silding window cookie expiration set up like this:

app.UseIdentity();
app.UseFacebookAuthentication();

and

services.AddIdentity<ApplicationUser, IdentityRole>((options =>
{
    options.Cookies.ApplicationCookie.CookieName = "myauthcookie";
    options.Cookies.ApplicationCookie.ExpireTimeSpan = TimeSpan.FromDays(5);
    options.Cookies.ApplicationCookie.SlidingExpiration = true;
}))
.AddEntityFrameworkStores<ApplicationDbContext>()
.AddDefaultTokenProviders();

This works fine when the user first logs in - the cookie expiration is set correctly. However, when the user returns to the page, the expiration of the cookie is set to "Session", so in practice the user has to re-authenticate every other visit.

Why is this happening? Have I not configured it correctly?

Update: I have now done some testing without SlidingExpiration, and the issue remains the same. Upon returning to the page, the expiration of the cookie is changed to "Session". I am using Chrome.

Also, I am not running on https. Might this be a factor?

Answer 1

Short Answer

Set isPersistent: true when calling SignInManager.ExternalLoginSignInAsync.

Details

In the ASP.NET Core Web Application template, the AccountController.ExternalLoginCallback method contains this code:

_signInManager.ExternalLoginSignInAsync(
    info.LoginProvider, 
    info.ProviderKey, 
    isPersistent: true);     <------ set a persistent cookie.

If we set isPersistent: true when calling ExternalLoginSignInAsync , this startup configuration...

services.AddIdentity<ApplicationUser, IdentityRole>(options =>
    {
        options.Cookies.ApplicationCookie.CookieName = "MyApplicationCookie";
        options.Cookies.ApplicationCookie.ExpireTimeSpan = TimeSpan.FromDays(5);
        options.Cookies.ApplicationCookie.SlidingExpiration = true;
    })
    .AddEntityFrameworkStores<ApplicationDbContext>()
    .AddDefaultTokenProviders();

...results in this application cookie...

...which persists across browser sessions.