Session cookie still authenticates after app pool recycle
<p>My ASP.NET MVC websites are staying signed in when I don't believe they should be.</p>
<p>My web server is IIS 7.5 and the app pool is V4.0 Integrated with idle-timeout set to 20 mins.</p>
<p>When logging in, the website saves an auth cookie that expires &quot;When the browsing session ends&quot; (persistence set to false).</p>
<p>If I close the browser (Chrome or FF) and then recycle (or stop/start) the app pool on IIS on the server, then reopen the browser, then session cookie still appears to be valid.</p>
<p>I know that Firefox and Chrome don't delete session cookies when you close the browser (so you can start where you left off), but surely the session doesn't exist on the server anymore, since the app pool has recycled? I'm not saving session data to a database, and don't have machine id's setup in my web.config.</p>
<p>Why is this cookie still valid?</p>
<h1>Edit 1 - how is the cookie set</h1>
<p>Cookie auth options are set by ConfigureAuth (called from the Configuration method in my OWIN Startup class). Cookie options:</p>
<pre><code>app.UseCookieAuthentication(new CookieAuthenticationOptions
{
    CookieName = &quot;MyCookieName&quot;,
    AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
    LoginPath = new PathString(&quot;/Account/Login&quot;),
    SlidingExpiration = true,
    ExpireTimeSpan = TimeSpan.FromDays(7) // this only applies if persistent is true!
});
</code></pre>
<p>The user is signed in using</p>
<pre><code>await SignInManager.SignInAsync(user, isPersistent, rememberBrowser);
</code></pre>
<p><code>isPersistent</code> is set from the &quot;Remember me&quot; check box on the login form. If this is checked then the cookie expires using the ExpireTimeSpan from the <code>CookieAuthenticationOptions</code>. If it's not checked, the the cookie expires &quot;When the browsing session ends&quot;, which is where my question lies.</p>
<p><code>rememberBrowser</code> is set to false - this is used for 2FA which is not used in my implementation.</p>
<p><code>SignInAsync</code> is the default implementation, which calls:</p>
<pre><code>AuthenticationManager.SignIn(new AuthenticationProperties()
    {
      IsPersistent = isPersistent
    }, userIdentity);
</code></pre>
<p>...which is again the default implementation.</p>
<p>The <code>AuthenticationManager</code> takes care of setting the actual cookie (I believe).</p>
<h1>Edit 2 - machineKey?</h1>
<p>Having looked into this further, it's possible that a machine key is being stored to the cookie, allowing it to authenticate across pool recycles. I have not defined a machineKey in the web.config, so I'm not sure this is correct.</p>