.NET Core Identity doesn't refresh auth cookie for static files and throws 500 error

Viewed 551

I have .NET Core Web API app with Angular 2 on client-side.
I setup .NET Core Identity with the following options in Startup.cs:

options.Password.RequiredLength = 5;                                              
options.Password.RequireDigit = false;
options.Password.RequireLowercase = false;
options.Password.RequireUppercase = false;
options.Password.RequireNonAlphanumeric = false;
options.SecurityStampValidationInterval = TimeSpan.FromMinutes(1);
options.Lockout.DefaultLockoutTimeSpan = TimeSpan.FromMinutes(5);
options.Lockout.MaxFailedAccessAttempts = 100;
options.Cookies.ApplicationCookie.ExpireTimeSpan = TimeSpan.FromDays(14);
options.Cookies.ApplicationCookie.LoginPath = "/api/signin/signin";
options.Cookies.ApplicationCookie.LogoutPath = "/api/signin/signout";
options.User.RequireUniqueEmail = false;

So,

  1. User is logged in - auth cookie is set.

  2. 60 seconds later - calls to API/* end-points update this cookie to a new value .. so calls work

  3. However calls to HTML/JS files do not update the cookie - they continue to use the previous cookie which now is presumably not tied to the session which then means we get the 500 error as it can't do something.

  4. Loading any API/* end-point updates the cookie and HTML/JS files work again.

So in short - the issue seems to be related to auth cookie not being refreshed for all the static content. And it just works fine without any cookie, when user is logged out.

How can I fix that? Thanks in advance.

1 Answers
Related