title: Authentication using API .net core
body: <p>I have the following setup. A Web API that uses Identity and Token Authorization, containing the whole User Management and ofcourse some extra API calls.</p>
  
  <p>Further I am building a FE to consume the API again with .net core. I have my Login form and post to the FE which uses RestSharp to do an API request giving the credentials I got from the form. And I receive some User Data and the Identity Cookie/Token.
  I set the cookie/token to the response and now my FE is able to use that to do other API calls with ajax for example.</p>
  
  <p>But my question is, how do I know that he is still logged in after X minutes? The API calls will get denied if the Cookie/token expired, but how does my FE-BE know that they are no longer valid? Do I check on every request the expiry date? 
  <a href="https://i.stack.imgur.com/pJyBX.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/pJyBX.png" alt="enter image description here"></a></p>
  
  <p>I am asking this mainly to challenge the way I have build my system to avoid any huge security flaws.</p>