title: Azure B2C Persistent Cookie
body: <p>I am using Azure B2C with one identity provider configured (LinkedIn).  I have a Web API (b2c bearer auth) and a Web App MVC (b2c Open Id).</p>
  
  <p>I'm trying to create a persistent login - meaning the user can login via LinkedIn once every 90 days from the given device+browser. </p>
  
  <p>The closest I've gotten is when I added IsPersistent = true code in the web app to enable that:</p>
  
  <p><strong>Update</strong>: Updated code based on Azure B2C GA.  To achieve where I was at with Preview, I still use a custom authorize attribute, but the code was updated:</p>
  
  <pre><code>protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext)
      {
            filterContext.HttpContext.GetOwinContext().Authentication.Challenge(
              new AuthenticationProperties()
              {
                  IsPersistent = true
              });
          base.HandleUnauthorizedRequest(filterContext);
      }
  </code></pre>
  
  <p>However, this is only valid for about 1 hour.  Perhaps it is following the Access &amp; ID policy?  With no bounds on the refresh token - I am not sure why only 1 hour for "IsPersistent".</p>
  
  <p><a href="http://i.stack.imgur.com/I9eL0.png" rel="nofollow">Token Session Config in Azure</a></p>
  
  <p>So that leads to these questions:</p>
  
  <ol>
  <li>Is a Persistent session (60-90 days) something I can achieve with Azure B2C (OpenId Connect)?</li>
  <li>If so, any pointers on what I am missing?  Do I need to do some custom cookie validation?   Something with refresh tokens (I use them for the web api, but nothing custom in the web app).</li>
  </ol>
  
  <p>Any thoughts or input would be great!</p>