{"action":"created","issue":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1363","labels_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1363/labels{/name}","comments_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1363/comments","events_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1363/events","html_url":"https://github.com/IdentityServer/IdentityServer3/issues/1363","id":76814182,"number":1363,"title":"Implement sliding expiration on asp.net webapi2 + sts + angularjs application","user":{"login":"gokulm","id":3050533,"avatar_url":"https://avatars.githubusercontent.com/u/3050533?v=3","gravatar_id":"","url":"https://api.github.com/users/gokulm","html_url":"https://github.com/gokulm","followers_url":"https://api.github.com/users/gokulm/followers","following_url":"https://api.github.com/users/gokulm/following{/other_user}","gists_url":"https://api.github.com/users/gokulm/gists{/gist_id}","starred_url":"https://api.github.com/users/gokulm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gokulm/subscriptions","organizations_url":"https://api.github.com/users/gokulm/orgs","repos_url":"https://api.github.com/users/gokulm/repos","events_url":"https://api.github.com/users/gokulm/events{/privacy}","received_events_url":"https://api.github.com/users/gokulm/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-05-15T18:30:34Z","updated_at":"2015-05-22T05:28:30Z","closed_at":null,"body":"We have WebAPI2, Thinktecture IdentityServer and AngularJS applications hosted on IIS. Our plan is to set up the webapi2 application stateless. Here is the flow:\r\n\r\nUsers open our AngularJS application. If not logged in, they get redirected to the login page.\r\nUsers enter their credentials, and click login. The credentials get sent to the STS server. If they get authenticated, a JWT gets returned.\r\nAngularJS saves the JWT in the localstorage\r\nTo access resources on the WebAPI, angularjs application attaches the JWT on every request.\r\nBefore attaching the JWT, it checks the JWT's expiration date. If it hasn't expired, request sent to the API; else, redirected to the login page.\r\nWe want the session to be be valid only for 30 minutes. As and when the user does something on the application, the token should slide the expiration datetime. The easiest solution could be enabling sessions for the WebAPI application, but we don't want that. Also, we don't want to get a token before every WebAPI call.\r\n\r\nCould we implement sliding sessions/tokens in this scenario? If so, how?\r\n\r\nPosted the same on StackOverflow - http://stackoverflow.com/questions/30243681/implement-sliding-expiration-on-asp-net-webapi2-sts-angularjs-application"},"comment":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/comments/104514911","html_url":"https://github.com/IdentityServer/IdentityServer3/issues/1363#issuecomment-104514911","issue_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1363","id":104514911,"user":{"login":"leastprivilege","id":1454075,"avatar_url":"https://avatars.githubusercontent.com/u/1454075?v=3","gravatar_id":"","url":"https://api.github.com/users/leastprivilege","html_url":"https://github.com/leastprivilege","followers_url":"https://api.github.com/users/leastprivilege/followers","following_url":"https://api.github.com/users/leastprivilege/following{/other_user}","gists_url":"https://api.github.com/users/leastprivilege/gists{/gist_id}","starred_url":"https://api.github.com/users/leastprivilege/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/leastprivilege/subscriptions","organizations_url":"https://api.github.com/users/leastprivilege/orgs","repos_url":"https://api.github.com/users/leastprivilege/repos","events_url":"https://api.github.com/users/leastprivilege/events{/privacy}","received_events_url":"https://api.github.com/users/leastprivilege/received_events","type":"User","site_admin":false},"created_at":"2015-05-22T05:28:30Z","updated_at":"2015-05-22T05:28:30Z","body":"Tokens do not support sliding. You need to do the token management on the client.\r\n\r\nSee here for a helper library:\r\n\r\nhttps://github.com/IdentityModel/oidc-token-manager"}}