Sliding expiration session cookie using IdentityServer3

1
votes

I am using a mix of a browser (Xamarin webview; to initially login and getting an access token that expires in 1 hour) and httpclient (to access my webapi endpoint). When the token expires I request a new one using the /connect/authorize endpoint using a httpclient (with the cookies copied from the webview) to get a new access token.

This works alright as long as the cookies aren't expired.

I've set up identity server to have a sliding expiration of 1 day on the authentication cookie (CookieOptions: ExpireTimeSpan/SlidingExpiration). I thought that this would result (besides getting a new valid token) in receiving new cookies on every request to the authentication endpoint, effectively keeping me logged in. The problem is that the expiry of the initial cookie that I received when logging in using the webview is used. So no matter how many times I access the authorization endpoint, I'm still logged out after a day and I can't get a new token from the authentication endpoint anymore.

Assuming I'm not completely taking the wrong approach, what requests should get me updated cookies (IdSvr? IdSvr.Session? which do I need anyway?) with a new expiry date, so I stay logged in to IdentityServer?

Note: I did take a look at refresh tokens, but these aren't available for implicit flow. And I think I need implicit flow in my case because I shouldn't save a client secret in a distributed Xamarin app. Using the cookies seems like the best alternative.

1
identityserver3

1 Answers

4
votes

Note to self (and others): the authentication cookie is the one that's important. For the record: that's the idsrv cookie.

Then the thing that confused me during testing: calling the /authorize endpoint will only return a new authorize (idsrv) cookie when at least half the expiration time has been passed.

This surprises me a bit, because that would mean that:

  • 8:00 log in with sliding exp of 4 hrs (expire time: 12:00)
  • 9:59 request to /authorize endpoint (expected new expire time: 13:59)
  • 12:01 request to /authorize again

The 12:01 request would fail miserably, because the 9:59 call did not get me an updated cookie...

Had I made de second request two minutes later at 10:01, I would have gotten an updated cookie with expire time of 14:01.

Conclusion: sliding expiration seems only be sliding when half the expiration time has passed.