Blog

ASP.NET Core Cookie Authentication in Depth: Session Lifetime, Sliding Expiration, Server-Side Sessions and Revocation

Sliding expiration alone can keep a session alive forever; you have to add an absolute timeout yourself with OnValidatePrincipal, and revocation needs state on the server (ITicketStore or a version stamp). We show the cookie ticket's contents, the 14-day default, renewal at half the window, chunking, server-side sessions in Redis and signing out of all devices with real outputs.