key for ticket in asp ticket store for login

Question

I am doing app with login with ticket store. Problem is that I wish to obtain new key to be in cookie

each time it is used. So I wish new key after each use. I tried to log out and log in controller to get new key but it fails to work. It gives me same key. How to get different value for ticket in cookie each time it is used?

The code for MemoryTicketStore

using Microsoft.Extensions.Caching.Memory;
using Microsoft.AspNetCore.Authentication.Cookies;
using Microsoft.AspNetCore.Authentication;

public class MemoryCacheTicketStore : ITicketStore
{
    private IMemoryCache _cache;

    public MemoryCacheTicketStore()
    {
        _cache = new MemoryCache(new MemoryCacheOptions());
    }

    public async Task ClearAll()
    {
        _cache.Dispose();
        _cache = new MemoryCache(new MemoryCacheOptions());
    }

    public async Task StoreAsync(AuthenticationTicket ticket)
    {
        var guid = Guid.NewGuid();
        var key = DateTime.Now + guid.ToString();
        await RenewAsync(key, ticket);
        return key;
    }

    public Task RenewAsync(string key, AuthenticationTicket ticket)
    {
        var options = new MemoryCacheEntryOptions();
        var expiresUtc = ticket.Properties.ExpiresUtc;
        if (expiresUtc.HasValue)
        {
            options.SetAbsoluteExpiration(expiresUtc.Value);
        }
        options.SetSlidingExpiration(TimeSpan.FromDays(100*356));//on server
        _cache.Set(key, ticket, options);
        return Task.FromResult(0);
    }

    public Task RetrieveAsync(string key)
    {
        AuthenticationTicket ticket;
        _cache.TryGetValue(key, out ticket);
        return Task.FromResult(ticket);
    }

    public Task RemoveAsync(string key)
    {
        _cache.Remove(key);
        return Task.FromResult(0);
    }
}

The code for program.cs is

builder.Services.AddDbContext(options => options.UseMySql(connectionString, ServerVersion.AutoDetect(connectionString)));
builder.Services.AddIdentity()
      .AddEntityFrameworkStores();

MemoryCacheTicketStore memoryCacheTicketStore = new MemoryCacheTicketStore();
builder.Services.AddSingleton(memoryCacheTicketStore);
builder.Services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
    .AddCookie();

builder.Services.ConfigureApplicationCookie(options =>
{
    options.ExpireTimeSpan = TimeSpan.FromDays(356*100);//on server
    options.SlidingExpiration = true;
    options.SessionStore = memoryCacheTicketStore;
    options.Cookie.Name = "identity_token";
});

Answer 1

a ticketstore is used to store the cookie authentication values outside the cookie so the cookie only has the key. the store can not change the cookie's key. you would need to change the cookie middleware to change the key on every request. to do this you will need to implement some solution to handle concurrent requests, as the server does not know the completion order.