Cookies are not refreshed in .NET Core 3.1

Question

I have an MVC .NET Core 3.1 application that uses Open ID connect for authentication and stores identity & tokens in cookies. The tokens need to be refreshed as they are used in some API requests our application does. I subscribe to ValidatePrincipal event and refresh the tokens there. The request goes OK, but cookies are not updated for some reason.

Startup.cs:

services.Configure(options =>
{
    options.CheckConsentNeeded = context => true;
    options.MinimumSameSitePolicy = SameSiteMode.None;
    options.OnAppendCookie = (e) =>
    {
        e.CookieOptions.Domain = 
    };
});
...
.AddCookie(options =>
{
    options.ExpireTimeSpan = TimeSpan.FromDays(30);
    options.Cookie.Domain = ;
    options.Cookie.IsEssential = true;
    options.Cookie.Name = 
    options.EventsType = typeof(CookieAuthEvents);
})

CookieAuthEvents.cs (constructor, member declarations and logging are omitted):

public override async Task ValidatePrincipal(CookieValidatePrincipalContext context)
{
    if (context.Principal.Identity.IsAuthenticated)
    {
        var now = DateTime.UtcNow;
        var tokenExpiration = context.Properties.GetTokenExpiration();

        if (now > tokenExpiration)
        {
            await UpdateCookies(context);
        }
    }
}

private async Task UpdateCookies(CookieValidatePrincipalContext context)
{
    var refreshToken = context.Properties.GetTokenValue(OpenIdConnectGrantTypes.RefreshToken);

    if (String.IsNullOrEmpty(refreshToken))
    {
        return;
    }

    var response = await GetTokenClient().RequestRefreshTokenAsync(refreshToken);

    if (!response.IsError)
    {
        WriteCookies(context, response);
    }
    else
    {
        context.RejectPrincipal();
    }
}

private void WriteCookies(CookieValidatePrincipalContext context, TokenResponse response)
{
    var tokens = new List
    {
        new AuthenticationToken
        {
            Name = OpenIdConnectParameterNames.IdToken,
            Value = response.IdentityToken
        },
        new AuthenticationToken
        {
            Name = OpenIdConnectParameterNames.AccessToken,
            Value = response.AccessToken
        },
        new AuthenticationToken
        {
            Name = OpenIdConnectParameterNames.RefreshToken,
            Value = response.RefreshToken
        },
        new AuthenticationToken
        {
            Name = OpenIdConnectParameterNames.TokenType,
            Value = response.TokenType
        }
    };

    var expiresAt = DateTime.UtcNow.AddSeconds(response.ExpiresIn);
    tokens.Add(new AuthenticationToken
    {
        Name = "expires_at",
        Value = expiresAt.ToString("o", CultureInfo.InvariantCulture)
    });

    var newPrincipal = GetNewPrincipal(context);

    context.ReplacePrincipal(newPrincipal);
    context.Properties.StoreTokens(tokens);
    context.ShouldRenew = true;
}

private static ClaimsPrincipal GetNewPrincipal(CookieValidatePrincipalContext context)
{
    var claims = context.Principal.Claims.Select(c => new Claim(c.Type, c.Value)).ToList();
    var authTimeClaim = claims.FirstOrDefault(claim => claim.Type.Same("auth_time"));

    if (authTimeClaim != null)
    {
        claims.Remove(authTimeClaim);
    }

    claims.Add(new Claim("auth_time", DateTime.UtcNow.UnixTimestamp().ToString()));

    return new ClaimsPrincipal(new ClaimsIdentity(claims, context.Principal.Identity.AuthenticationType));
}

The main problem is this works perfectly fine locally. All the calls are fine, cookies are refreshed correctly. But when the app is run from dev machine (we host it in Azure App Service) RequestRefreshTokenAsync call is successful, but the cookies are not updated therefore all the next calls are made with an old tokens leading to 400 invalid_grant error. So basically what I see in logs is:

RequestRefreshTokenAsync successful. The old refresh_token is used to get a new one
ValidatePrincipal successful. Here the cookies should be rewritten (including a new refresh_token)
Next request - RequestRefreshTokenAsync failed. The old refresh_token is used (even though it's invalid).

I tried playing with cookies configurations and placing semaphores and locks inside ValidatePrincipal method but none of it worked.

Does anyone have an idea what can cause that?

Cookies are not refreshed in .NET Core 3.1

0 Answers