ASP.NET MVC 5 Owin Identity 在允许 ExpiresUtc 之前丢失了答案

【问题标题】：ASP.NET MVC 5 Owin Identity got lost before allowed ExpiresUtcASP.NET MVC 5 Owin Identity 在允许 ExpiresUtc 之前丢失了
【发布时间】：2019-07-14 16:29:43
【问题描述】：

public void ConfigureAuth(IAppBuilder app)
{
    app.UseKentorOwinCookieSaver(PipelineStage.Authenticate);
    app.UseCookieAuthentication(new CookieAuthenticationOptions
            {
                AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
                LoginPath = new PathString("/Login"),
                LogoutPath = new PathString("/Logout"),
                CookieSecure = CookieSecureOption.SameAsRequest ,
                SlidingExpiration = true,
                CookieName = ".app",
                CookieHttpOnly = true,
                CookiePath = "/",
                CookieDomain = Domain
            });

我的登录方法：

private void IdentitySignin(AppUserState appUserState, bool isPersistent = false)
{
    var Browser = Request.Browser + Request.Browser.Version;

    var claims = new List<Claim>
            {
                // create required claims
                new Claim(ClaimTypes.NameIdentifier, appUserState.UserId),
                new Claim(ClaimTypes.Name, appUserState.Name),
                new Claim(ClaimTypes.Role, appUserState.RoleName),
                new Claim(ClaimTypes.UserData, Browser.GetHashCode().ToString()),

                // User State Info
                new Claim("userState", appUserState.ToString())
            };

    var identity = new ClaimsIdentity(claims, DefaultAuthenticationTypes.ApplicationCookie);

    AuthenticationManager.SignIn(new AuthenticationProperties()
            {
                AllowRefresh = true,
                IsPersistent = isPersistent,
                //Dictionary = { { "RememberMe", isPersistent ? "true" : "false" } },
                ExpiresUtc = isPersistent ? DateTime.UtcNow.AddHours(3) : DateTime.UtcNow.AddMinutes(20)
            }, identity);
}

我预计 cookie 应该存活 3 小时，但不到 15 分钟就会过期。

它在本地按预期工作，但这仅在我部署到 IIS 时才会发生。

我应该将 asp.net 会话超时设置为与过期超时相同吗？
是否应该包括任何其他 IIS 配置？

【问题讨论】：

标签： asp.net-mvc owin identity katana

【解决方案1】：

经过长时间的研究，我发现我必须将以下行添加到我的web.config文件中

<system.web>
   <sessionState mode="StateServer" timeout="1200" cookieless="false" />
</system.web>

【讨论】：