AspNet.Security.OpenIdConnect.Server - invalid token when update .net core project

[AspNet.Security.OpenIdConnect.Server] 2.0.0-rc2-final

Doubt about refresh token.

Is there any mechanism so that after updating a .net core project (DLLs), or with the application restart (IIS), a token can be revalidated so that the user remains valid and logged in?

today with each new update of my project, the token is invalidated and the user is disconnected from the application and a new login is required.

after an update the returned message is: The specified refresh token is invalid.

thanks.

Solution

Are you using a developer certificate to sign the token? It seems that you don't use a fixed certificate. The certificate is used to encode and decode the token. If the certificate changes (on restart of the app) then all tokens become invalid.

To set a fixed signing certificate:

var cert = new X509Certificate2("TokenCertificate.pfx", "MySecret", 
                                              X509KeyStorageFlags.MachineKeySet | 
                                              X509KeyStorageFlags.PersistKeySet | 
                                              X509KeyStorageFlags.Exportable);

services
    .AddAuthentication( ... )
    .AddJwtBearer( ... )
    .AddOpenIdConnectServer(options =>
        {
            options.SigningCredentials.AddCertificate(cert);
            ...
        });