I'm working on an OpenID Connect Hybrid flow, basically the response type in my case is: code id_token Problem: I can't seem to persist the session of the user when logged in using the id_token.

I built the app using .Net Core's built in OpenID Connect authentication handler and Cookies handler. However, the cookies are session cookies, so they expire the moment the browser is closed, in which case the user is logged out and has to login again when he opens the browser. Which got me thinking, that I haven't been using refresh tokens even though I've been asking for them from the Authorization server. So, the question to rule them all: How do I persist the user's login on the browser so he will have to login just once? I realize Cookies should have an expiry date and not be regular session cookies and I also realize that I should be using refresh tokens to re-authenticate the user again behind the scenes and thus produce a new cookie in the process. However, Is my thinking right? If yes, how to do that ? If not, what did I get wrong?

Update: I solved the problem of the session cookie expiring but adding an "IsPersistent" property in the authentication challenge I used to login, and the OpenID Connect authentication handler took care of the rest. However, the Cookie only lasts 60 mintues, which is the duration of the id_token. So, we still have the problem of not being able to ask for a new token using the refresh token?!

  • How long is the session in the provider valid for? How long is the refresh token valid for? There are also some trade-offs here, with respect to convenience for the user and security around session and refresh token life span.
    – Thomas Owens
    Jul 15, 2019 at 12:05
  • @ThomasOwens, the session token is valid for one hour, the refresh token for 14 days. The goal here is to improve the user experience.
    – Hamza
    Jul 17, 2019 at 6:46
  • Can you share the config changes as I'm not seeing a setting for "IsPersistant" Oct 30, 2023 at 20:02

2 Answers 2


I did this myself recently and it's a bit of a pain, largely due to the limitations on the extension method setup methods which restrict your control over the component, forcing you to use CookieAuth when you don't really want to.

What I setup was Cookie, JWT and OpenIdConnect authentication. in the cookie auth we forward events to the JWT or OpenId auth

.AddCookie(options =>
    options.ForwardAuthenticate = JwtBearerDefaults.AuthenticationScheme;
    options.ForwardChallenge = OpenIdConnectDefaults.AuthenticationScheme;
    options.Events = new CookieAuthenticationEvents()
        OnRedirectToAccessDenied = async ctx =>
            ctx.Response.StatusCode = 401;


In the JWT auth we check our own cookie:

options.Events = new JwtBearerEvents()
    OnMessageReceived = async ctx =>
        //get the token from the cookie rather than the header
        var token = ctx.HttpContext.Request.Cookies["access_token"];
        ctx.Token = token;

In the OpenId auth we set the cookie

ctx.Response.Cookies.Append("access_token", tokenResponse.AccessToken);
  • I solved the problem by using an "IsPersistent" property in the authentication challenge. However, the login session only lasts for the duration of the id_token. Which is an hour, how do I make the application ask for a new token using the refresh token?
    – Hamza
    Jul 17, 2019 at 6:49
  • 1
    if you save the refresh token to a cookie you can have the openid auth read it so it can get a new token as required
    – Ewan
    Jul 17, 2019 at 7:00
  • how do you suggest I do that?
    – Hamza
    Jul 17, 2019 at 7:03
  • as in my example code above, but also add the refresh token
    – Ewan
    Jul 17, 2019 at 7:25

Don't use refresh tokens to keep the user logged in! Refresh tokens are intended for offline access, i.e. background processed where the user is not present at all.

The correct way to handle this situation is just to re-authenticate the user against the openid provider once the id_token has expired. The openid provider should take care of remembering who is logged in (e.g. through a persistent cookie), and immediately redirect back to the application without re-authenticating the user. If the user is paying attention then they will see a couple of redirects back and forth, but they won't need to enter their password again.

If you are the author of the openid provider then you will need to be careful with cookie / session durations to make this work smoothly, e.g. if you use rolling sessions on your openid provider then you will want to make sure that the expiry on the id_token is short enough that the user will get re-authenticated before the openid providers session cookie has expired.

If your openid provider re-authenticates every time (i.e. doesn't support any form of session), then your best bet is to just to completely ignore the expiry time in the id_token.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.