Syncing OWIN Cookie Expiration (sliding) and session timeout
<h3>Background</h3>
<p>I have a semi-single-page application (all server interaction after login takes place on one page via ajax calls) that uses both session storage and OWIN cookie authentication.  Both session and cookie expiration are set to 15 minutes and the cookie is configured to use sliding expiration.</p>
<p>On every server interaction, a timer on the client is reset back to 15 minutes.  If no activity is recorded for 14 minutes, a modal is displayed with a ticker alerting the user that the session will timeout soon.</p>
<h3>Issue</h3>
<p>We are running into an issue where in certain cases our session is outliving the OWIN cookie.</p>
<p>Per the <a href="https://msdn.microsoft.com/en-us/library/microsoft.owin.security.cookies.cookieauthenticationoptions(v=vs.113).aspx" rel="noreferrer">CookieAuthenticationOptions</a> class:</p>
<blockquote>
<p>The SlidingExpiration is set to true to instruct the middleware to re-issue a new cookie with a new expiration time any time it processes a request <strong>which is more than halfway through the expiration window</strong>.</p>
</blockquote>
<p>We have the scenario where users use the application prior to &quot;half way through the expiration window”, then let the application sit idle for a few minutes. When the users see the session expiration notification, they try to renew their sessions.  But since the OWIN cookie was never renewed, the app times out and redirects them to the login page (prematurely based on what the expiration notification says).</p>
<p>This <a href="https://support.microsoft.com/en-us/kb/910443" rel="noreferrer">support article</a> illustrates our situation exactly:</p>
<blockquote>
<p>Let us take an example: If the logon page is accessed at 5:00 00:00:00 PM, it should expire at 5:10 00:00:00 PM if the timeout attribute is 10 and the slidingExpiration attribute is set to TRUE. Now, if any Web page is browsed again at 5:05 00:00:00 PM, the cookies and ticket time-out period will be reset to 5:15 00:00:00 PM.</p>
<p><strong>Note If the Web page is accessed before half of the expiration time passes, the ticket expiration time will not be reset. Fore example, if any Web page is accessed again at 5:04 00:00:00 PM, the cookies and ticket timeout period will not be reset.</strong></p>
</blockquote>
<h3>Question/Comments</h3>
<p>Has anyone ever run into this before?  How do we avoid it?  Adjusting the OWIN timeout only prolongs the issue.</p>
<p>I can't help to think that this is either a terrible design flaw in the OWIN framework, OR we are not using it correctly.</p>
<p>Any help is appreciated.  Thanks.</p>