I'm experiencing a strange issue. I have two websites, one is a clone of the other. On website #1 (the original), logins are persistent and users aren't logged out until they choose to logout themselves.
Both websites are running ASP.NET Core 2.2
Website #1 login code:
[HttpPost("login")]
public async Task<IActionResult> Login(LoginVM model)
{
if (ModelState.IsValid)
{
var signInAttempt = await _signInManager.PasswordSignInAsync(model.Email, model.Password, true, false);
if (signInAttempt.Succeeded)
{
if (!string.IsNullOrEmpty(model.ReturnUrl))
{
return Redirect(model.ReturnUrl);
}
return RedirectToAction("Home");
}
if (signInAttempt.IsLockedOut)
{
ModelState.AddModelError("", _stringLocalizer["User is locked out"]);
}
else
{
ModelState.AddModelError("", _stringLocalizer["Email and password do not match"]);
}
}
return View(model);
}
On website #2 (the clone), the logins aren't persistent and users are logged out after some time - I'm not sure after how long.
Website #2 login code:
[HttpPost("login")]
public async Task<IActionResult> Login(LoginVM model)
{
if (ModelState.IsValid)
{
var signInAttempt = await _signInManager.PasswordSignInAsync(model.Email, model.Password, true, false);
if (signInAttempt.Succeeded)
{
if (!string.IsNullOrEmpty(model.ReturnUrl))
{
return Redirect(model.ReturnUrl);
}
return RedirectToAction("Home");
}
if (signInAttempt.IsLockedOut)
{
ModelState.AddModelError("", _stringLocalizer["User is locked out"]);
}
else
{
ModelState.AddModelError("", _stringLocalizer["Email and password do not match"]);
}
}
return View(model);
}
So, as you can see from above, both codes are exactly the same - both are set to true in persistence. In the websites Startup file, they're also identical:
Website #1 Startup.cs:
services.AddIdentity<ApplicationUser, IdentityRole>(options =>
{
// Configure identity options here.
options.Password.RequireDigit = false;
options.Password.RequiredLength = 4;
options.Password.RequireLowercase = false;
options.Password.RequireNonAlphanumeric = false;
options.Password.RequireUppercase = false;
}).AddEntityFrameworkStores<ApplicationDbContext>();
services.ConfigureApplicationCookie(options =>
{
options.AccessDeniedPath = "/login";
options.LoginPath = "/login";
options.LogoutPath = "/logout";
});
Website #2 Startup.cs:
services.AddIdentity<ApplicationUser, IdentityRole>(options =>
{
// Configure identity options here.
options.Password.RequireDigit = false;
options.Password.RequiredLength = 4;
options.Password.RequireLowercase = false;
options.Password.RequireNonAlphanumeric = false;
options.Password.RequireUppercase = false;
}).AddEntityFrameworkStores<ApplicationDbContext>();
services.ConfigureApplicationCookie(options =>
{
options.AccessDeniedPath = "/login";
options.LoginPath = "/login";
options.LogoutPath = "/logout";
});
So, my question is: How do I achieve persistent logins on website #2?
UPDATE: Users are also logged out when application pool is recycled - this also doesn't happen in website #1.