Cookie not expiring for Azure AD auth

问题

I am adding Azure AD Authentication to an ASP.NET Core application. The Application is registered in Azure AD and has custom roles setup in the manifest. These roles are used for Authorization policies within the app. Everything is working when users log in, they get redirected to sign in to Azure and come back with a Cookie containing their Claims.

My issue is that unless the Cookie is deleted in the browser, these Claims persist and aren't refreshed when Roles in Azure change. For example if a User signs in, then I remove them from a Role, they will still be seen as in that Role by the application.

I tried setting a 1 minute expiration to the Cookie, but it doesn't have an impact and I still have the same issue. Here is how the auth is configured in Startup. (AddAzureAd() comes from this example: https://github.com/Azure-Samples/active-directory-dotnet-webapp-openidconnect-aspnetcore/blob/master/Extensions/AzureAdAuthenticationBuilderExtensions.cs):

        services.AddAuthentication(options =>
        {
            options.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme;
            options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
            options.DefaultSignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
        })
        .AddAzureAd(options =>
        {
            options.ClientId = azureAdOptions.ClientId;
            options.ClientSecret = azureAdOptions.ClientSecret;
            options.Instance = azureAdOptions.Instance;
            options.Domain = azureAdOptions.Domain;
            options.TenantId = azureAdOptions.TenantId;
            options.CallbackPath = azureAdOptions.CallbackPath;
        })
        .AddCookie(options =>
        {
            options.Cookie.Expiration = TimeSpan.FromMinutes(1);
            options.ExpireTimeSpan = TimeSpan.FromMinutes(1);
        });

Update: Changing Expires to MaxAge in the Cookie configuration sets a Max Age for the Cookie in the browser that the browser respects, and works as it should. But why does ExpireTimeSpan not do anything and accept Cookies older than 1 minute?

Cookie options updated to this:

        .AddCookie(options =>
        {
            options.Events.OnSignedIn = async e =>
            {
                e.Properties.IsPersistent = true;
                e.Properties.ExpiresUtc = DateTime.UtcNow.AddMinutes(1);
            };
        });

But it still is accepting Cookies much older. If I sign in, remain on a page for 5 minutes, then refresh it authenticates using the same cookie. Roles, etc. are not updated.

回答1:

If you want to control the authentication ticket lifetime , you can use :

services.AddAuthentication(AzureADDefaults.AuthenticationScheme)
            .AddAzureAD(options => Configuration.Bind("AzureAd", options));

services.Configure<OpenIdConnectOptions>(AzureADDefaults.OpenIdScheme, options =>
{
    options.UseTokenLifetime = false;
    ...

});

services.Configure<CookieAuthenticationOptions>(AzureADDefaults.CookieScheme, options =>
{
    options.ExpireTimeSpan = TimeSpan.FromMinutes(1);
    ...

});

So that after 1 minutes , the ticket expires , when requesting in a page , it will send authorize request to AAD , if AAD user is active , it will automatically sign-in again to get the new tokens and map to user claims .

回答2:

But why does ExpireTimeSpan not do anything and accept Cookies older than 1 minute?

An absolute expiration time can be set with ExpiresUtc. To create a persistent cookie, IsPersistent must also be set. Otherwise, the cookie is created with a session-based lifetime and could expire either before or after the authentication ticket that it holds. When ExpiresUtc is set, it overrides the value of the ExpireTimeSpan option.

await HttpContext.SignInAsync(
    CookieAuthenticationDefaults.AuthenticationScheme,
    new ClaimsPrincipal(claimsIdentity),
    new AuthenticationProperties
    {
        IsPersistent = true,
        ExpiresUtc = DateTime.UtcNow.AddMinutes(20)
    }
);

The TimeSpan after which the authentication ticket stored inside the cookie expires. ExpireTimeSpan is added to the current time to create the expiration time for the ticket. The ExpiredTimeSpan value always goes into the encrypted AuthTicket verified by the server. It may also go into the Set-Cookie header, but only if IsPersistent is set. To set IsPersistent to true, configure the AuthenticationProperties passed to SignInAsync. The default value of ExpireTimeSpan is 14 days.

来源：https://stackoverflow.com/questions/58226163/cookie-not-expiring-for-azure-ad-auth