title: What is max expiry for ASP.NET Identity Two Factor code?
body: <p>I'm trying to find out what is the max value for a two factor authentication code from ASP.NET Identity 2.1.</p>
  
  <p>I have tried setting the following:</p>
  
  <pre><code>app.UseTwoFactorSignInCookie(DefaultAuthenticationTypes.TwoFactorCookie, TimeSpan.FromMinutes(60))
  </code></pre>
  
  <p>but the code isn't good for that long, so I'm wondering if perhaps this is the expiry for the cookie itself and not the code it contains. I'm wondering if there is a technical limitation to how long the verification code can last, based on how it is generated.</p>
  
  <p>All of the examples simply stick with 5 minutes, so I'm wondering if this is the actual limit. I read somewhere that there is an extra 90 second allowance on top of the 5 minutes, and so that seems to be around what I am getting.</p>
  
  <p>I noticed this question (<a href="https://stackoverflow.com/questions/28087302/asp-net-identity-2-two-factor-security-code-timespan">ASP.Net Identity 2, Two Factor Security Code timespan</a>) was looking to do the same thing, but there wasn't an accepted answer and it is almost 1.5 years old, so thought I'd ask from a limit point of view before I bother trying to change it according to that answer.</p>