title: WIF SessionSecurityToken Expiration
body: <p>I'm trying to implement sliding session expiration. I'm using Windows Azure ACS, .Net 4.5, WIF. When I first receive the token, what I'm doing is setting its default expiration time to 2 hours and write that token into cookie as shown in the code below:</p>
  
  <pre><code>internal void SetSession(ClaimsPrincipal principal)
  {
      var sessionToken = new SessionSecurityToken(principal, TimeSpan.FromMinutes(120));
      FederatedAuthentication.SessionAuthenticationModule.WriteSessionTokenToCookie(sessionToken);
      Thread.CurrentPrincipal = principal;
  }
  </code></pre>
  
  <p>At this time, if I check the <code>ValidFrom</code> and <code>ValidTo</code> properties of the <code>sessionToken</code> variable, I get proper values as shown in the screenshot below:</p>
  
  <p><img src="https://i.stack.imgur.com/56geh.png" alt="enter image description here"></p>
  
  <p>Now to implement sliding session expiration, I am handling <code>SessionAuthenticationModule_SessionSecurityTokenReceived</code> event in my <code>Global.asax</code> file as shown below:</p>
  
  <pre><code>    void SessionAuthenticationModule_SessionSecurityTokenReceived(object sender, SessionSecurityTokenReceivedEventArgs e)
      {
          var sessionToken = e.SessionToken;
      }
  </code></pre>
  
  <p>However when I check the <code>ValidFrom</code> and <code>ValidTo</code> properties of the token, it's not what I set when I was writing the token as the cookie as shown in the screenshot below:</p>
  
  <p><img src="https://i.stack.imgur.com/HKXDz.png" alt="enter image description here"></p>
  
  <p>Not sure why this is happening. Can anybody please explain what I'm doing wrong.</p>
  
  <p><strong>UPDATE:</strong></p>
  
  <p>Here's one interesting thing I noticed. The way I've implemented sliding session is that I check token's <code>ValidTo</code> property and compare that with current date/time (in UTC). If the difference is less than 5 minutes, I increase the <code>ValidTo</code> time by 2 hours and reissue the cookie as shown in the code below:</p>
  
  <pre><code>    void SessionAuthenticationModule_SessionSecurityTokenReceived(object sender, SessionSecurityTokenReceivedEventArgs e)
      {
          var sessionToken = e.SessionToken;
          var currentDateTime = DateTime.UtcNow.Ticks;
          var sessionExpirationDateTime = sessionToken.ValidTo.Ticks;
          if (sessionExpirationDateTime &gt;= currentDateTime)
          {
              var renewTokenWindow = 5 * 60 * 1000;//5 minutes
              TimeSpan ts = new TimeSpan(sessionExpirationDateTime - currentDateTime);
              if (ts.TotalMilliseconds &lt; renewTokenWindow)
              {
                  var newSessionTokenExpiry = sessionToken.ValidTo.AddMinutes(120);
                  //Renew token
                  SessionAuthenticationModule sam = sender as SessionAuthenticationModule;
                  var newSessionToken = sam.CreateSessionSecurityToken(sessionToken.ClaimsPrincipal, sessionToken.Context, sessionToken.ValidFrom, newSessionTokenExpiry, sessionToken.IsPersistent);
                  e.SessionToken = newSessionToken;
                  e.ReissueCookie = true;
              }
          }
      }
  </code></pre>
  
  <p>Now after that if I check the value of <code>ValidTo</code> property in subsequent requests, it is actually honoring the value I'm setting as shown below. And this value gets persisted request after request i.e. once I reissue the token, everything works well.</p>
  
  <p><img src="https://i.stack.imgur.com/9M6d5.png" alt="enter image description here"></p>