title: Authentication cookie always deleted after validateInterval using CookieAuthenticationProvider OnValidateIdentity
body: <p><strong>Background</strong> <em>skip if you like</em></p>
  
  <p>I am working on a .NET (4.5.2) web application which uses CookieAuthentication and OpenIdConnectAuthentication (integrated with Azure AD) provided by OWIN middleware.</p>
  
  <p>A penetration test from the client has highlighted that, even after the user signs out, the cookie is still authorised and could therefore be used to submit requests. This is expected behavior, but I need to find a way around it.</p>
  
  <p>I am attempting to implement the workaround in this <a href="https://stackoverflow.com/questions/34020730/invalidate-old-session-cookie-asp-net-identity">related post</a>, i.e. use the <code>SecurityStampValidator.OnValidateIdentity</code> method along with calling <code>UserManager.UpdateSecurityStampAsync</code> to effectively invalidate the cookie on sign out. </p>
  
  <p><strong>Code</strong> <em>can provide more on request, if helpful</em></p>
  
  <p>I have adding the <code>CookieAuthenticationProvider</code> with <code>OnValidateIdentity</code> within my <code>ConfigureAuth</code> method:</p>
  
  <pre><code>app.UseCookieAuthentication(new CookieAuthenticationOptions {
    CookieName = "whatever",
    Provider = new CookieAuthenticationProvider
    {
      OnValidateIdentity = SecurityStampValidator.OnValidateIdentity&lt;ApplicationUserManager, ApplicationUser&gt;(
          validateInterval: TimeSpan.FromMinutes(1),
          regenerateIdentity: (manager, user) =&gt; user.GenerateUserIdentityAsync(manager)
      ),
    },
  });
  </code></pre>
  
  <p>I have also added <code>UseTokenLifetime = false</code> to the OpenIdConnectAuthenticationOptions as per <a href="https://stackoverflow.com/questions/47574561/onvalidateidentity-in-owin-cookie-authentication-not-called/47576578#47576578">this helpful post</a>.</p>
  
  <p>I plan on adding <code>UserManager.UpdateSecurityStampAsync(User.Identity.GetUserId());</code> in the sign out process, but I've not got as far as testing that yet.</p>
  
  <p>In case it is relevant, here is my sign in initiator:</p>
  
  <pre><code>Request.GetOwinContext().Authentication.Challenge(
    new AuthenticationProperties { RedirectUri = Request.ApplicationPath },
    OpenIdConnectAuthenticationDefaults.AuthenticationType);
  </code></pre>
  
  <p><strong>My Expectation</strong></p>
  
  <p>As the SecurityStamp should not have changed, after the <code>validateInterval</code> (1 minute) everything should continue to work as normal (the user's existing cookie remains valid).</p>
  
  <p><strong>Result</strong></p>
  
  <p>The first request after > 1 minute from sign-in results in the following set-cookie response header being returned:</p>
  
  <blockquote>
    <p>whatever=; path=/; expires=Thu, 01-Jan-1970 00:00:00 GMT</p>
  </blockquote>
  
  <p>And therefore the user's cookie is removed and they are signed-out.</p>
  
  <p><strong>Question(s)</strong></p>
  
  <p>Is my expectation valid, or am I misunderstanding <code>validateInterval</code>? Is there a way I can get the above to work how I want it to? Is it possible that the SecurityStamp is being changed somewhere in the sign-in process without me realising, after the initial cookie is created?</p>