ASP.NET Core 2.0 Identity Expiration

[CarbonFactory]

There is a cookie with the name ".AspNetCore.Identity.Application" added after I login the user and it's expiration time is set to 14 days from now, 2017-11-05T15:52:03.669Z

 services.AddIdentity<ApplicationUser, ApplicationRole>()
                .AddEntityFrameworkStores<ApplicationDbContext>()
                .AddUserManager<ApplicationUserManager>()
                .AddSignInManager<ApplicationSignInManagerr>()
                .AddDefaultTokenProviders();


services.AddMvc(opts =>
            {
                opts.Filters.AddService(typeof(AjaxAntiforgeryCookieResultFilter));
            })
 services
                .AddAuthentication()
                .AddJwtBearer(options =>
                {
                    options.RequireHttpsMetadata = false;
                    options.SaveToken = true;
                    options.TokenValidationParameters = tokenValidationParameters;
                    options.Events = jwtBearerEvents;
                });

            services.ConfigureApplicationCookie(options =>
            {
                options.AccessDeniedPath = new PathString("/login");
                options.LoginPath = new PathString("/login");
                options.Cookie.Expiration = TimeSpan.FromMinutes(1);
            });

            services.AddAuthorization();

Above is the related part of the code for brevity.

How do I ensure that after 10 mins, if the user refreshes the webpage, he is logged out and re-directed to login.

The ConfigureApplicationCookie values seem to be ignored.

[turboka4]

Experiencing same issue. Expire time just equals session.

[blowdart]

You need to be setting options.ExpireTimeSpan rather than options.Cookie.Expiration.

This confusion arises because we have a common cookie builder, but identity actually controlling the cookie expiration ourselves. We realize this is confusing, and even though there are intellisense docs, they're not discoverable.

[blowdart]

Closing due to lack of response.

Experiencing same issue

[arisliang]

Same confusion exists for 1.x too. How to properly set the application expiry cookie in 1.x?