I have a requirement to expire the session after 10 minutes of inactivity of the application and send them to the authentication page. I am using Asp.net core 3.0 with angular 9 as SPA and in build Identity server 4.
The angular application checks the JWT token for validation, however, the angular app has no link with the session. What is the best way to solve this issue?
The configuration I did for the identity server
services.AddIdentityServer(options =>
{
options.UserInteraction.ErrorUrl = "/Identity/error";
options.Events.RaiseErrorEvents = true;
options.Events.RaiseFailureEvents = true;
options.Events.RaiseInformationEvents = true;
options.Authentication.CookieAuthenticationScheme = IdentityConstants.ApplicationScheme;
options.Authentication.CookieLifetime = TimeSpan.FromMinutes(10);
options.Authentication.CookieSlidingExpiration = true;
})
.AddSigningCredential(signingCert)
.AddInMemoryIdentityResources(IdSvrConfig.IdentityResources)
.AddInMemoryClients(IdSvrConfig.Clients)
.AddInMemoryApiResources(IdSvrConfig.Apis)
.AddAspNetIdentity<ApplicationUser>()
.AddProfileService<AspNetIdentityProfileService>();
Setting the below configuration should work, but it is not working
options.Authentication.CookieLifetime = TimeSpan.FromMinutes(10);
options.Authentication.CookieSlidingExpiration = true;
Also tried the below code
services.AddAuthentication().AddCookie(options =>
{
options.ExpireTimeSpan = TimeSpan.FromMinutes(10);
options.SlidingExpiration = true;
});
I have removed the remember me checkbox from the login page of the Identity server and in the controller, I have set the value to false as below
var result = await _signInManager.PasswordSignInAsync(Input.Email, Input.Password, false, lockoutOnFailure: true);
In the browser dev console, I can see the below cookies
Angular
public async completeSignIn(url: string): Promise<IAuthenticationResult> {
try {
await this.ensureUserManagerInitialized();
const user = await this.userManager.signinCallback(url);
this.userSubject.next(user);
return this.success(user && user.state);
} catch (error) {
console.log('There was an error signing in: ', error);
return this.error('There was an error signing in.');
}
}
The problem is that when the application is inactive for 10 minutes it doesn't redirect the user to the login page. Even if I close the browser and reopen it goes directly to the application without login process.
