title: Cookie not expiring for Azure AD auth
body: <p>I am adding Azure AD Authentication to an ASP.NET Core application. The Application is registered in Azure AD and has custom roles setup in the manifest. These roles are used for Authorization policies within the app. Everything is working when users log in, they get redirected to sign in to Azure and come back with a Cookie containing their Claims.</p>
  <p>My issue is that unless the Cookie is deleted in the browser, these Claims persist and aren't refreshed when Roles in Azure change. For example if a User signs in, then I remove them from a Role, they will still be seen as in that Role by the application.</p>
  <p>I tried setting a 1 minute expiration to the Cookie, but it doesn't have an impact and I still have the same issue. Here is how the auth is configured in <code>Startup</code>. (<code>AddAzureAd()</code> comes from this example: <a href="https://github.com/Azure-Samples/active-directory-dotnet-webapp-openidconnect-aspnetcore/blob/master/Extensions/AzureAdAuthenticationBuilderExtensions.cs" rel="nofollow noreferrer">https://github.com/Azure-Samples/active-directory-dotnet-webapp-openidconnect-aspnetcore/blob/master/Extensions/AzureAdAuthenticationBuilderExtensions.cs</a>):</p>
  <pre class="lang-cs prettyprint-override"><code>services.AddAuthentication(options =&gt;
  {
      options.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme;
      options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
      options.DefaultSignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
  })
  .AddAzureAd(options =&gt;
  {
      options.ClientId = azureAdOptions.ClientId;
      options.ClientSecret = azureAdOptions.ClientSecret;
      options.Instance = azureAdOptions.Instance;
      options.Domain = azureAdOptions.Domain;
      options.TenantId = azureAdOptions.TenantId;
      options.CallbackPath = azureAdOptions.CallbackPath;
  })
  .AddCookie(options =&gt;
  {
      options.Cookie.Expiration = TimeSpan.FromMinutes(1);
      options.ExpireTimeSpan = TimeSpan.FromMinutes(1);
  });
  </code></pre>
  <p>Update: Changing <code>Expires</code> to <code>MaxAge</code> in the Cookie configuration sets a Max Age for the Cookie in the browser that the browser respects, and works as it should. But why does <code>ExpireTimeSpan</code> not do anything and accept Cookies older than 1 minute?</p>
  <p>Cookie options updated to this:</p>
  <pre class="lang-cs prettyprint-override"><code>.AddCookie(options =&gt;
  {
      options.Events.OnSignedIn = async e =&gt;
      {
          e.Properties.IsPersistent = true;
          e.Properties.ExpiresUtc = DateTime.UtcNow.AddMinutes(1);
      };
  });
  </code></pre>
  <p>But it still is accepting Cookies much older. If I sign in, remain on a page for 5 minutes, then refresh it authenticates using the same cookie. Roles, etc. are not updated.</p>