OWIN rejects authentication cookie the next day

Question

I have an ASP.NET MVC5 application with the generated startup configuration for using OWIN.

The user logs in to my application, keeps the browser opened but if he tries to access it the next day, the application redirects the user to the login page.

I cannot reproduce this problem on my developer machine, it only occurs on my current shared hosting provider. Actually it worked correctly on my previous provider.

The application pool gets restarted once in a while, but according to my experience, if I do a recycle manually, it does not cause the tokens to be invalidated (which should be the expected behavior as far as I know).

I tried setting sliding expiration explicitly and increasing the cookie validity, but it had no effect:

// Enable the application to use a cookie to store information for the signed in user
app.UseCookieAuthentication(new CookieAuthenticationOptions
{
     AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
     ExpireTimeSpan = TimeSpan.FromDays(365*20),
     SlidingExpiration = true,
     LoginPath = new PathString("/Account/Login")
});
// Use a cookie to temporarily store information about a user logging in with a third party login provider
app.UseExternalSignInCookie(DefaultAuthenticationTypes.ExternalCookie);

I am using .NET Framework 4.5. I tried to update all of my NuGet packages to the latest, but it did not solve the issue.

I checked and the expiration time of the cookies sent and they are correct, that should not be the problem. It happens in various browsers.

Pliny

does your provider dynamically change the OS which your app is on? if so, the machine key would change and the ticket would be invalid. Set the machine key on your web.config and try again if that is the case. – Poodle

My hosting provider states that always the same machine will serve my application. I tried setting a predefined machinekey based on http://msdn.microsoft.com/en-us/library/ff649308.aspx, I will test it in the next few days to make sure it is OK. Thanks for the answers! – Pliny

Answer 1

It's because the cookie is protected with the <machineKey> from ASP.NET. It sounds like your provider is doing something to trigger a app domain recycle or you're on a web farm so the machine key is not consistent. Try setting a <machineKey> in your web.config.

Galliett