Avoid session cookies in Asp.NET Core 2.2 + IdentityServer

2
votes

I've been playing with Asp.NET Core 2.2 and Identity, using examples explained here. In particular I'm using the StsServer app which allows a user to authenticate using OpenID Hybrid flow or Windows authentication.

What I have seen is that it stores: chrome

  • 3 session cookies if user identity is not remembered
  • 2 session cookies + 1 cookie if the user identity is remembered when the browser is reopened

Is there a way to avoid such cookies?

Thanks,

1
c#cookiesasp.net-core-mvcidentityserver4

1 Answers

5
votes

The .AspNetCore.AntiForgergy cookie is not a session cookie. It's for CSRF. The .AspNetCore.Identity cookie is also not a session cookie. It's the auth cookie that persists the user's authenticated state when using Identity and Identity Server backed by ASP.NET Core Identity. Finally, the idsrv.session cookie is from Identity Server, and is used for OIDC session management, which is not a "session" in the sense you're probably thinking of. It's there to support maintaining the authenticated state, as well.

Long and short, they each have a specific purpose and you need all of them.