In this post there is a discussion of multiple policies in B2C to secure different endpoints, thereby forcing someone to login again for more sensitive resources.
This sounds great, and was echoed in this SO post where examples of Facebook or Google were given.
I've tried implementing this, setting two acceptable policies on one controller and a single policy on another.
And if you choose the page with the less secure policy and login, and then you choose the other page with the more secure policy, you're asked to login again. So far, so good.
But now the cookie contains the short lived expiration from the secure policy, so you'll be asked to login again after that cookies expires, even though your cookie from the original less secure login is still valid. And your stuck logging in repeatedly after the short interval of the more secure cookie.
How do I tell it to switch back to use the still valid old cookie (if it even still exists)?
I've been thinking about this and I'm not sure if a better way to handle it is to check the issued at claim in the authorization policy to see if it was recent enough and if not, return unauthorized so they'll be forced to login again. They'll get another long lived token at that point, with a new issued at claim and they're good to go anywhere on the site.
Any ideas?
TIA
