基于 IPAddress 和客户端设备在 asp.net 核心 3.1 身份中设置 Cookie Expiration 时间跨度

Question

I am upgrading to asp.net core 3.1 with identity. Before I was setting cookies manually at login and updating each time the client made a request.

I would like to update the cookie expiration based on the clients IPAddress and device each time a request is made. Those who login from home would only get 4 hours, those who login from the office would get days, those who login from their iPhone would get a different amount of time.

Is it possible to override asp.net core identities existing middleware that updates the cookie expiration datetime? I know you can set the cookie expiration in startup using:

        services.AddAuthentication()
                .AddCookie(cfg =>
                {
                    cfg.ExpireTimeSpan = TimeSpan.FromMinutes(20);
                    cfg.LoginPath = @"/Account/Login";
                    cfg.LogoutPath = @"/Account/Logout";
                    cfg.Cookie.Domain = ".MyDomain.com";
                    cfg.SlidingExpiration = true;
                });

But I do not want to set the expire time statically. Any help would be appreciated.

Answer 1

I did a lot of research and found very little to make this possible. I ended up creating my own middleware that updated the cookie on each request. I am not sure the impact this has on load times but so far is hasn't effect load time much.

I set up identity and used the signin manager API as normal

I set up Configure Services in my start up class like this:

 public void ConfigureServices(IServiceCollection services)
 {
            //Other Services Here...    

            services.AddIdentity<User, IdentityRole>(cfg =>
            {
                cfg.User.RequireUniqueEmail = true;
            })
               .AddEntityFrameworkStores<SJRContext>()
               .AddSignInManager<SJRSignInManager<User>>()
               .AddDefaultTokenProviders()
               .AddTokenProvider<CustomTwoFactorTokenProvider<User>>("TwoFactorAuthToken");

            services.AddAuthentication()
                .AddCookie(cfg =>
                {
                    cfg.ExpireTimeSpan = TimeSpan.FromMinutes(20);
                    cfg.LoginPath = @"/Account/Login";
                    cfg.LogoutPath = @"/Account/Logout";
                    cfg.SlidingExpiration = true;
                    cfg.Cookie.Expiration = TimeSpan.FromMinutes(30);
                    cfg.Cookie.Domain = Configuration.GetSection("AppDomain").Value;
                });
}

I then signed the users in on my account controller like this:

var result = await _signInManager.PasswordSignInAsync(user, model.Password, true, false);
if (result.Succeeded)
{
   //Redirect
}
else
{ 
   //Return model error
}

And then I added my own custom middleware to my pipeline on Configure method of my start up class like this:

 public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
        {

            //Other Middleware here...

            app.Use(async (ctx, next) =>
            {
                const string cookieName = ".AspNetCore.Identity.Application";
                //Get cookie
                var val = ctx.Request.Cookies[cookieName];

                if (string.IsNullOrEmpty(val) == false)
                {
                    //Init Constants
                    const int externalMaxHourLimit = 8;
                    const string sessionStartTime = "sessionStartTime";

                    //Get ip
                    var ip = ctx.Request.HttpContext.Connection.RemoteIpAddress.ToString();

                    //Get device type
                    var deviceType = ctx.Request.Headers["User-Agent"].ToString();

                    //Check ip
                    var isInHouse = WorkordersDomain.Security.Security.isIPAddressInSJRollins(ip);

                    //init cookie options
                    var cookieOptions = new CookieOptions()
                    {
                        SameSite = SameSiteMode.Strict,
                        Secure = true,
                        Domain = Configuration.GetSection("AppDomain").Value,
                        Expires = DateTime.Now.AddHours(Convert.ToInt32(Configuration.GetSection("CookieExpiration:Default").Value))
                    };

                    //Set cookie expiration
                    if (isInHouse)
                    {
                        cookieOptions.Expires = DateTime.Now.AddHours(Convert.ToInt32(Configuration.GetSection("CookieExpiration:InHouse").Value));
                    }
                    else if (deviceType.Contains("iphone"))
                    {
                        cookieOptions.Expires = DateTime.Now.AddDays(Convert.ToInt32(Configuration.GetSection("CookieExpiration:iPhone").Value));
                    }
                    else
                    {
                        //Default
                        if (ctx.Session.IsAvailable)
                        {
                            if (ctx.Session.Get(sessionStartTime) == null)
                            {
                                ctx.Session.SetString(sessionStartTime, DateTime.Now.ToString());
                            }
                            else
                            {
                                var sessionStart = Convert.ToDateTime(ctx.Session.GetString(sessionStartTime));
                                if (DateTime.Now > sessionStart.AddHours(externalMaxHourLimit))
                                {
                                    cookieOptions.Expires = DateTime.Now.AddMinutes(-10);
                                    ctx.Session.Remove(sessionStartTime);
                                }
                            }
                        }
                    }

                    //update cookie
                    ctx.Response.Cookies.Append(cookieName, val, cookieOptions);
                }

                //Go to next middleware
                await next();

            });

            //Other Middleware here...
}

This middleware gets the identity cookie based on the key ".AspNetCore.Identity.Application" That will always be the same and I use the context parameter to find out the user agent and IP address of the client. Then I just need to return the new cookie in the response with the same key and value pair and it replaces the old cookie with the new cookie and updated expiration time.