Question

Stackoverflow uses OpenId as many other websites. However, I rarely need to provide my OpenId to Stackoverflow while with other OpenId enabled websites, I have to do it once a day or week.

This suggests to me that the expiry of the session is with the website and not the OpenId provider.

Looking at the DotNetOpenId code in ASP MVC, I can see that after a successful authentication by the OpenId provider FormsAuthentication.SetAuthCookie is called with the identifier and a boolean parameter to determine if the cookie should be persisted.

How can I force this cookie to expire, say in 2020 instead of whatever the default value is.

Answer 1

From MSDN – Explained: Forms Authentication in ASP.NET 2.0:

FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(1,
    "userName",
    DateTime.Now,
    new DateTime(2020, 01, 01), // value of time out property
    false, // Value of IsPersistent property
    String.Empty,
    FormsAuthentication.FormsCookiePath);

string encryptedTicket = FormsAuthentication.Encrypt(ticket);

HttpCookie authCookie = new HttpCookie(
                        FormsAuthentication.FormsCookieName, 
                        encryptedTicket);

authCookie.Secure = true;

Response.Cookies.Add(authCookie);