I'm using Sitecore 9.1.1 and logging users into the front-end of my site using the AuthenticationManager.Login(domainUser, password, persist) call. By default I'm sending "true" for the persist variable. My understanding is this should keep them logged in indefinitely, but it seems after a few hours their authentication expires and they have to log in again. The client wants to keep the user logged in for at least 24 hours.

Is this a case where I should be adding on a manual "FormsAuthenticationTicket" call to increase the timeout of the authentication cookie, or is there a method/setting to use to change that expiration?

2 Answers 2


If your solution is using OWIN authentication with Identity Server (enabled by default in SC 9.1+ instances), you should be able to change the default 30 minutes lifetime of the OWIN authentication cookie (.Aspnet.Cookies) making the following changes:

  1. Patch the ExpireTimeSpan parameter of the CookieAuthentication processor in your Sitecore web application:
        <processor name="CookieAuthentication" type="Sitecore.Owin.Authentication.Pipelines.Initialize.CookieAuthentication, Sitecore.Owin.Authentication">
  1. Modify the CookieLifetime parameter in the \sitecore\Sitecore.Plugin.IdentityServer\Config\identityServer.xml configuration file in your Identity Server host application:

Update your configuration values for the timeout setting in the system.web section of the web.config file. Note the values are in minutes, for example below snippet shows both session state timeout and authentication timeout set to 30 minutes.

    <authentication mode="None">
      <forms name=".ASPXAUTH" cookieless="UseCookies" timeout="30"/>
    <sessionState timeout="30" regenerateExpiredSessionId="false"/>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.