IdentityServer4 ignores RememberMe

Question

I am working on a project with IdentityServer4, Asp.Net.Identity and all is done in MVC and Razor. I have most of it working, the only thing I am struggling with is the RememberMe capability. Currently Idsrv sets the cookie even though RememberMe is false when logging in.

Here is my code:

The LoginModel challenges Idsrv with the oidc Authentication Scheme.

public class LoginModel : PageModel {
    public IActionResult OnGet() {
        return Challenge(new AuthenticationProperties {
                         RedirectUri = "/" }, "oidc");
        }
    }
}

Here is my startup extension method for the client authentication

public static void AddClientAuthentication(this IServiceCollection services) {
    services.AddAuthentication(options => {
        options.DefaultScheme = "Cookies";
        options.DefaultChallengeScheme = "oidc";
    })
    .AddCookie("Cookies")
    .AddOpenIdConnect("oidc", options => {
        options.SignInScheme = "Cookies";
        options.Authority = AuthorityUrl;
        options.RequireHttpsMetadata = true;
        options.ResponseType = "code id_token";
        options.SaveTokens = true;
        options.ClientId = "*ClientId*";
        options.ClientSecret = "*ClientSecret*";
        options.Scope.Add("profile");
        options.Scope.Add("openid");
   });
}

And here is my login-logic:

[HttpPost]
[ValidateAntiForgeryToken]
public async Task<IActionResult> Login(LoginViewModel model) {
    if (!ModelState.IsValid) {
        return View(model);
    }

    SignInResult result = await signInManager.PasswordSignInAsync(model.Email, model.Password, model.RememberLogin, true);

    if (result.Succeeded) {
        ApplicationUser user = await userManager.FindByEmailAsync(model.Email);

        await events.RaiseAsync(new UserLoginSuccessEvent(user.UserName, user.Id, user.UserName));
        return Redirect("https://localhost:5002/home");
    }

The issue is, that cookies are set even though model.RememberLogin is false. Does anyone have a solution for that? Thank you in advance!

Answer 1

So, it was not a bug in my code. I didn't know that there is a cookie set for the duration of the browser session.