title: Still logged in MVC site, but can't call web API
body: <p>I have an ASP.NET MVC site, IdentityServer4 host and a web API.</p>
  
  <p>When I log in the MVC site, using external provider (Facebook), I'm logged in fine. From the MVC site I can also consume the web API correctly.</p>
  
  <p>However, the next day, I'm still logged in into the MVC site, but when I then try to access the web API, I get a 'not authorized exception'.</p>
  
  <p>So although I'm still logged in in the MVC site, I'm not authenticated anymore to call a web API from within the MVC site. </p>
  
  <p>I'm wondering how to handle this situation, and how IdentityServer4 should be configured. </p>
  
  <ul>
  <li>Why am I still logged in the MVC site a day later? How can this be configured? </li>
  <li>Why can't I still call the web API, if I'm still logged in the MVC site?</li>
  <li>Can I sync the expiration times? Or how should I handle this?</li>
  </ul>
  
  <p>The MVC application is configured like:</p>
  
  <pre><code> services.AddAuthentication(options =&gt;
          {
              options.DefaultScheme = "Cookies";
              options.DefaultChallengeScheme = "oidc"; 
          })
          .AddCookie("Cookies")
          .AddOpenIdConnect("oidc", options =&gt;
          {
              options.SignInScheme = "Cookies";
              options.Authority = mgpIdSvrSettings.Authority;
              options.RequireHttpsMetadata = false;                
              options.ClientId = mgpIdSvrSettings.ClientId;
              options.ClientSecret = mgpIdSvrSettings.ClientSecret; // Should match the secret at IdentityServer
              options.ResponseType = "code id_token"; // Use hybrid flow
              options.SaveTokens = true;                
              options.GetClaimsFromUserInfoEndpoint = true;                
              options.Scope.Add("mgpApi");
              options.Scope.Add("offline_access");                  
          });            
  </code></pre>
  
  <p>So it's using hybrid flow. </p>
  
  <p>In IdentityServer the MVC client is configured like:</p>
  
  <pre><code>new Client
  {
       EnableLocalLogin = false,
  
       ClientId = "mgpPortal",
       ClientName = "MGP Portal Site",
       AllowedGrantTypes = GrantTypes.Hybrid,
  
       // where to redirect to after login
       RedirectUris = mgpPortalSite.RedirectUris,
  
       // where to redirect to after logout
       PostLogoutRedirectUris = mgpPortalSite.PostLogoutRedirectUris,
  
       // secret for authentication
       ClientSecrets = mgpPortalSite.ClientSecrets.Select(cs =&gt; new Secret(cs.Sha256())).ToList(),
  
       AllowedScopes = new List&lt;string&gt;
       {
              IdentityServerConstants.StandardScopes.OpenId,
              IdentityServerConstants.StandardScopes.Profile,
              "mgpApi"
       },
  
       AllowOfflineAccess = true,                             
       RequireConsent = false,
  },
  </code></pre>
  
  <p>And finally the web API:</p>
  
  <pre><code> services.AddAuthentication("Bearer")                
             .AddIdentityServerAuthentication(options =&gt;
              {
                  options.Authority = mgpIdSvrSettings.Authority;
                  options.RequireHttpsMetadata = false;                    
                  options.ApiName = mgpIdSvrSettings.ApiName;
                  options.EnableCaching = true;
                  options.CacheDuration = TimeSpan.FromMinutes(10);                    
              });
  </code></pre>