.Net Core 3.1 - Google Auth Cookie Not Persisting

Question

I recently upgraded my ASP.Net Core MVC web app to .Net Core 3.1, and ever since, the Google External login cookie hasn't persisted properly as it did before the upgrade. The code itself didn't change at all, the app was just upgraded from .Net Core 2.0 to .Net Core 3.1.

The login flow works (user clicks login button, Google login screen appears, user logs in with Google Credentials/selects existing Google user and is sent back to the web app), but at random times (sometimes 30-60 seconds after login), the user's session randomly ends and the user is redirected back to the login screen. I've tested this extensively on localhost and the issue does not occur, but happens frequently on the hosting service I'm using (MochaHost).

Has anyone else had this issue with .Net Core 3.1?

The ConfigureServices method used at startup is below for reference.

    public void ConfigureServices(IServiceCollection services)
    {
        services.AddLogging();

        services.AddResponseCompression(options =>
        {
            options.Providers.Add<GzipCompressionProvider>();
            options.EnableForHttps = true;
        });

        services.Configure<MvcOptions>(options =>
        {
            options.Filters.Add(new RequireHttpsAttribute());
        });

        services.AddDbContext<ApplicationDbContext>(options =>
            options.UseMySql(Configuration["ConnectionStrings:MySQL"]));

        services.AddIdentity<ApplicationUser, IdentityRole>()
              .AddEntityFrameworkStores<ApplicationDbContext>()
              .AddUserStore<UserStore>()
              .AddDefaultTokenProviders();

        services.AddAuthentication().AddGoogle(options =>
        {
            options.ClientId = Configuration["Authentication:Google:ClientId"];
            options.ClientSecret = Configuration["Authentication:Google:ClientSecret"];
            options.CallbackPath = new PathString("/signin-google");
        });

        services.ConfigureApplicationCookie(options =>
        {
            options.AccessDeniedPath = "/error/401";
            options.Cookie.Name = "MyApp";
            options.Cookie.HttpOnly = true;
            options.ExpireTimeSpan = TimeSpan.FromMinutes(180);
            options.LoginPath = "/login";
            options.ReturnUrlParameter = CookieAuthenticationDefaults.ReturnUrlParameter;
            options.SlidingExpiration = true;
        });

        services.AddMvc(option => option.EnableEndpointRouting = false);
        services.AddSingleton<IHttpContextAccessor, HttpContextAccessor>();
        services.AddSingleton<IFileProvider>(new PhysicalFileProvider(Configuration.GetValue<string>("RootFilePath")));
        var serviceAccountFilePath = GetGoogleServiceAccountCredentialPath();
        var googleCredential = GoogleCredential.FromFile(serviceAccountFilePath);
        services.AddSingleton(StorageClient.Create(googleCredential));
    }

Answer 1

In my case, the issue was that Data Protection key storage was not available via user profile or HKLM registry after the .Net Core upgrade. I'm not sure if this is related to having to switch to 64-bit app pool mode after the upgrade to .Net Core 3.1 or not, but the bottom line is data protection keys were only being stored in memory. After shifting from server to server via the load balancer, the user keys were lost, causing a redirect back to the login page.

Sample Log entries:

2020-11-20 09:00:21.162 -08:00 [INF] Starting web host
2020-11-20 09:00:21.572 -08:00 [WRN] Using an in-memory repository. Keys will not be persisted to storage.
2020-11-20 09:00:21.574 -08:00 [WRN] Neither user profile nor HKLM registry available. Using an ephemeral key repository. Protected data will be unavailable when application exits.

I had to add the below code to use a folder on the hosting service to store key files so the user's session would persist:

        services.AddDataProtection()
            .PersistKeysToFileSystem(new DirectoryInfo(Configuration.GetValue<string>("KeyStorePath")));