OpenId ASP MVC Authentication with long expiry

Question

Stackoverflow uses OpenId as many other websites. However, I rarely need to provide my OpenId to Stackoverflow while with other OpenId enabled websites, I have to do it once a day or week.

This suggests to me that the expiry of the session is with the website and not the OpenId provider.

Looking at the DotNetOpenId code in ASP MVC, I can see that after a successful authentication by the OpenId provider FormsAuthentication.SetAuthCookie is called with the identifier and a boolean parameter to determine if the cookie should be persisted.

How can I force this cookie to expire, say in 2020 instead of whatever the default value is.

Answer 1

You can use FormsAuthentication.RenewTicketIfOld() to update the ticket. This method would check if the current ticket has expired and if not, to extend its expiration. You can call this method on every request to your site, which will "slide" th expiration further in future as the user keeps using your site.

Answer 2

From MSDN - Explained: Forms Authentication in ASP.NET 2.0:

FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(1,
    "userName",
    DateTime.Now,
    new DateTime(2020, 01, 01), // value of time out property
    false, // Value of IsPersistent property
    String.Empty,
    FormsAuthentication.FormsCookiePath);

string encryptedTicket = FormsAuthentication.Encrypt(ticket);

HttpCookie authCookie = new HttpCookie(
                        FormsAuthentication.FormsCookieName, 
                        encryptedTicket);

authCookie.Secure = true;

Response.Cookies.Add(authCookie);