Authenticating with "remember me" not persisting beyond a few hours

Question

I'm using Sitecore 9.1.1 and logging users into the front-end of my site using the AuthenticationManager.Login(domainUser, password, persist) call. By default I'm sending "true" for the persist variable. My understanding is this should keep them logged in indefinitely, but it seems after a few hours their authentication expires and they have to log in again. The client wants to keep the user logged in for at least 24 hours.

Is this a case where I should be adding on a manual "FormsAuthenticationTicket" call to increase the timeout of the authentication cookie, or is there a method/setting to use to change that expiration?

Answer 1

If your solution is using OWIN authentication with Identity Server (enabled by default in SC 9.1+ instances), you should be able to change the default 30 minutes lifetime of the OWIN authentication cookie (.Aspnet.Cookies) making the following changes:

1. Patch the ExpireTimeSpan parameter of the CookieAuthentication processor in your Sitecore web application:

<pipelines>
      <owin.initialize>
        <processor name="CookieAuthentication" type="Sitecore.Owin.Authentication.Pipelines.Initialize.CookieAuthentication, Sitecore.Owin.Authentication">
          <ExpireTimeSpan>0:00:30:00</ExpireTimeSpan>
        </processor>
      </owin.initialize>
</pipelines>

2. Modify the CookieLifetime parameter in the \sitecore\Sitecore.Plugin.IdentityServer\Config\identityServer.xml configuration file in your Identity Server host application:

<Settings>
  <Sitecore>
    <IdentityServer>
      <Authentication>
        <CookieLifetime>0.00:30:00</CookieLifetime>
...

Answer 2

Update your configuration values for the timeout setting in the system.web section of the web.config file. Note the values are in minutes, for example below snippet shows both session state timeout and authentication timeout set to 30 minutes.

  <system.web>
    <authentication mode="None">
      <forms name=".ASPXAUTH" cookieless="UseCookies" timeout="30"/>
    </authentication>
    <sessionState timeout="30" regenerateExpiredSessionId="false"/>
  </system.web>