ASP.Net Identity ASPNET.ApplicationCookie looks different when I check it

Question

I tried to find a clear answer about why I see this behavior. I am using the Microsoft ASP.NET Identity template project to see how Identity, OWIN etc. works. I notice that every time I make a request (go to "Contacts", "Management", etc.). My AspNet.ApplicationCookie has a different encrypted string (when using the developer tools in Chrome or IE). At first I thought that maybe because I did not make any complaints to the user, but I tried to add some complaints and still saw the same behavior. Has anyone seen / knew why? Is it just an encrypted cookie change due to how the OWIN middleware encrypts the cookie? Any help is appreciated.

I read https://brockallen.com/2013/10/24/a-primer-on-owin-cookie-authentication-middleware-for-the-asp-net-developer/
and also http: //tech.trailmax. info / 2014/08 / aspnet-identity-cookie-format /

but I don’t understand why I see the behavior that I see. Thanks again to everyone.

UPDATE: Here is my startup.Auth.cs

 public void ConfigureAuth(IAppBuilder app)
    {

        // Configure the db context, user manager and signin manager to use a single instance per request
        app.CreatePerOwinContext(ApplicationDbContext.Create);
        app.CreatePerOwinContext<ApplicationUserManager>(ApplicationUserManager.Create);
        app.CreatePerOwinContext<ApplicationSignInManager>(ApplicationSignInManager.Create);

        // Enable the application to use a cookie to store information for the signed in user
        // and to use a cookie to temporarily store information about a user logging in with a third party login provider
        // Configure the sign in cookie
        app.UseCookieAuthentication(new CookieAuthenticationOptions
        {

            AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
            LoginPath = new PathString("/Account/Login"),
            LogoutPath = new PathString("/Account/LogOff"),
            Provider = new CookieAuthenticationProvider
            {
                // Enables the application to validate the security stamp when the user logs in.
                // This is a security feature which is used when you change a password or add an external login to your account.  
                OnValidateIdentity = SecurityStampValidator.OnValidateIdentity<ApplicationUserManager, ApplicationUser>(
                    validateInterval: TimeSpan.FromMinutes(0),
                    regenerateIdentity: (manager, user) => user.GenerateUserIdentityAsync(manager))
            },
        });            
        //app.UseExternalSignInCookie(DefaultAuthenticationTypes.ExternalCookie);

        // these two lines of code are needed if you are using any of the external authentication middleware
        app.Properties["Microsoft.Owin.Security.Constants.DefaultSignInAsAuthenticationType"] = "ExternalCookie";
        app.UseCookieAuthentication(new CookieAuthenticationOptions
        {
            AuthenticationType = "ExternalCookie",
            AuthenticationMode = Microsoft.Owin.Security.AuthenticationMode.Passive,
        });

        // Enables the application to temporarily store user information when they are verifying the second factor in the two-factor authentication process.
        app.UseTwoFactorSignInCookie(DefaultAuthenticationTypes.TwoFactorCookie, TimeSpan.FromMinutes(5));

        // Enables the application to remember the second login verification factor such as phone or email.
        // Once you check this option, your second step of verification during the login process will be remembered on the device where you logged in from.
        // This is similar to the RememberMe option when you log in.
        app.UseTwoFactorRememberBrowserCookie(DefaultAuthenticationTypes.TwoFactorRememberBrowserCookie);
}

Answer 1

Your problem is consistent validateInterval: TimeSpan.FromMinutes(0),Here, you actually say "regenerate cookie on every request" - this is for the global invalidity of cookies when changing the security brand.

validateInterval - cookie , , .