Implementing Remember Me Functionality

In this lesson, you will learn how to transition from transient session cookies to persistent authentication cookies that keep users logged in after they close their browser.

The Persistent Cookie Mechanism

When a user signs in, the standard SignInAsync method creates a session cookie. By default, this cookie is deleted the moment the browser process terminates. To implement "Remember Me," we must instruct the authentication middleware to issue a persistent cookie.

A persistent cookie includes an expiration date (the Expires property), which tells the browser to store the identity data on the local disk rather than volatile memory. When the user returns, the browser presents this persistent cookie, and the CookieAuthenticationHandler validates it, re-establishing the user's session without requiring them to re-enter credentials.

Implementation in the Sign-In Workflow

You control this behavior via the AuthenticationProperties object when calling SignInAsync. By setting IsPersistent to true, you shift the cookie from a "session" type to a "persistent" type.

var properties = new AuthenticationProperties
{
    IsPersistent = true,
    ExpiresUtc = DateTimeOffset.UtcNow.AddDays(30)
};

await HttpContext.SignInAsync(
    IdentityConstants.ApplicationScheme,
    userPrincipal,
    properties);

Security Considerations

While convenient, persistent cookies increase the risk of session hijacking if a computer is shared. To mitigate this:

1. Never store sensitive data in the cookie itself. Use claims to identify the user, but keep the actual user state in your secure data store.
2. Restrict Expiration: Even with "Remember Me," don’t set the ExpiresUtc indefinitely. A period of 14 to 30 days is standard to balance user convenience with security.
3. Use Sliding Expiration: If configured in your authentication middleware, the persistent cookie can be updated to extend its lifetime each time the user visits, ensuring active users aren't logged out unexpectedly.

By explicitly setting the IsPersistent flag in your AuthenticationProperties, you effectively signal to the browser that this authentication session should survive a restart, creating a seamless experience for your users while adhering to Identity security patterns.

Key Takeaway: Setting IsPersistent = true in the AuthenticationProperties shifts your cookie from browser-memory storage to persistent disk storage, allowing users to remain authenticated across browser restarts.