.NET Core Identity doesn't refresh auth cookie for static files and throws 500 error

Question

I have .NET Core Web API app with Angular 2 on client-side.
I setup .NET Core Identity with the following options in Startup.cs:

options.Password.RequiredLength = 5;                                              
options.Password.RequireDigit = false;
options.Password.RequireLowercase = false;
options.Password.RequireUppercase = false;
options.Password.RequireNonAlphanumeric = false;
options.SecurityStampValidationInterval = TimeSpan.FromMinutes(1);
options.Lockout.DefaultLockoutTimeSpan = TimeSpan.FromMinutes(5);
options.Lockout.MaxFailedAccessAttempts = 100;
options.Cookies.ApplicationCookie.ExpireTimeSpan = TimeSpan.FromDays(14);
options.Cookies.ApplicationCookie.LoginPath = "/api/signin/signin";
options.Cookies.ApplicationCookie.LogoutPath = "/api/signin/signout";
options.User.RequireUniqueEmail = false;

So,

1. User is logged in - auth cookie is set.

2. 60 seconds later - calls to API/* end-points update this cookie to a new value .. so calls work

3. However calls to HTML/JS files do not update the cookie - they continue to use the previous cookie which now is presumably not tied to the session which then means we get the 500 error as it can't do something.

4. Loading any API/* end-point updates the cookie and HTML/JS files work again.

So in short - the issue seems to be related to auth cookie not being refreshed for all the static content. And it just works fine without any cookie, when user is logged out.

How can I fix that? Thanks in advance.

Answer 1

According to docs section Introduction to working with static files in ASP.NET Core:

The static file module provides no authorization checks.

Solution for this (from the same article):

• Store them outside of wwwroot and any directory accessible to the static file middleware and
• Serve them through a controller action, returning a FileResult where authorization is applied

So basically you have to either make some requests for your API constantly to update the session or create some dummy controller for static files.