I'm working on an OpenID Connect Hybrid flow, basically the response type in my case is: code id_token Problem: I can't seem to persist the session of the user when logged in using the id_token.
I built the app using .Net Core's built in OpenID Connect authentication handler and Cookies handler. However, the cookies are session cookies, so they expire the moment the browser is closed, in which case the user is logged out and has to login again when he opens the browser. Which got me thinking, that I haven't been using refresh tokens even though I've been asking for them from the Authorization server. So, the question to rule them all: How do I persist the user's login on the browser so he will have to login just once? I realize Cookies should have an expiry date and not be regular session cookies and I also realize that I should be using refresh tokens to re-authenticate the user again behind the scenes and thus produce a new cookie in the process. However, Is my thinking right? If yes, how to do that ? If not, what did I get wrong?
Update: I solved the problem of the session cookie expiring but adding an "IsPersistent" property in the authentication challenge I used to login, and the OpenID Connect authentication handler took care of the rest. However, the Cookie only lasts 60 mintues, which is the duration of the id_token. So, we still have the problem of not being able to ask for a new token using the refresh token?!