I'm working on an OpenID Connect Hybrid flow, basically the response type in my case is: code id_token Problem: I can't seem to persist the session of the user when logged in using the id_token.

I built the app using .Net Core's built in OpenID Connect authentication handler and Cookies handler. However, the cookies are session cookies, so they expire the moment the browser is closed, in which case the user is logged out and has to login again when he opens the browser. Which got me thinking, that I haven't been using refresh tokens even though I've been asking for them from the Authorization server. So, the question to rule them all: How do I persist the user's login on the browser so he will have to login just once? I realize Cookies should have an expiry date and not be regular session cookies and I also realize that I should be using refresh tokens to re-authenticate the user again behind the scenes and thus produce a new cookie in the process. However, Is my thinking right? If yes, how to do that ? If not, what did I get wrong?

Update: I solved the problem of the session cookie expiring but adding an "IsPersistent" property in the authentication challenge I used to login, and the OpenID Connect authentication handler took care of the rest. However, the Cookie only lasts 60 mintues, which is the duration of the id_token. So, we still have the problem of not being able to ask for a new token using the refresh token?!

  • How long is the session in the provider valid for? How long is the refresh token valid for? There are also some trade-offs here, with respect to convenience for the user and security around session and refresh token life span. – Thomas Owens Jul 15 at 12:05
  • @ThomasOwens, the session token is valid for one hour, the refresh token for 14 days. The goal here is to improve the user experience. – Hamza Jul 17 at 6:46

I did this myself recently and it's a bit of a pain, largely due to the limitations on the extension method setup methods which restrict your control over the component, forcing you to use CookieAuth when you don't really want to.

What I setup was Cookie, JWT and OpenIdConnect authentication. in the cookie auth we forward events to the JWT or OpenId auth

.AddCookie(options =>
    options.ForwardAuthenticate = JwtBearerDefaults.AuthenticationScheme;
    options.ForwardChallenge = OpenIdConnectDefaults.AuthenticationScheme;
    options.Events = new CookieAuthenticationEvents()
        OnRedirectToAccessDenied = async ctx =>
            ctx.Response.StatusCode = 401;


In the JWT auth we check our own cookie:

options.Events = new JwtBearerEvents()
    OnMessageReceived = async ctx =>
        //get the token from the cookie rather than the header
        var token = ctx.HttpContext.Request.Cookies["access_token"];
        ctx.Token = token;

In the OpenId auth we set the cookie

ctx.Response.Cookies.Append("access_token", tokenResponse.AccessToken);
  • I solved the problem by using an "IsPersistent" property in the authentication challenge. However, the login session only lasts for the duration of the id_token. Which is an hour, how do I make the application ask for a new token using the refresh token? – Hamza Jul 17 at 6:49
  • 1
    if you save the refresh token to a cookie you can have the openid auth read it so it can get a new token as required – Ewan Jul 17 at 7:00
  • how do you suggest I do that? – Hamza Jul 17 at 7:03
  • as in my example code above, but also add the refresh token – Ewan Jul 17 at 7:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.