title: MachineKeySessionSecurityTokenHandler and the session token expiring between application restarts
body: <p>In my MVC application, I am using forms authentication to authenticate the user and then <code>System.IdentityModel.Services.SessionAuthenticationModule</code> to persist the session.</p>
  
  <p>While I'm not yet at the point where it's necessary, I did want to utilize <code>System.IdentityModel.Services.Tokens.MachineKeySessionSecurityTokenHandler</code> so that the application will live nicely on a web farm (as described by Dominick Baier <a href="http://leastprivilege.com/2012/07/12/machinekey-based-session-protection-for-wif/">here</a>).</p>
  
  <p>The problem I have is that, given the machineKey-based handling, I would expect that not only would the session be valid from server machine to machine, but should also survive application restarts.  However, any time I either restart or rebuild the application, upon hitting the application in the browser, the cookie apparently becomes invalid and I get bounced to the authentication screen.  Once authenticated again, everything is fine and the session remains.  However, the next time the app restarts or is rebuilt, I'm forced to re-authenticate.</p>
  
  <p>I'm sure this is an aspect of WIF that I'm not getting, but I just don't know where to turn from here.  I'm not afraid of having to extend <code>MachineKeySessionSecurityTokenHandler</code>, but I'd like to make sure that I understand what's going on here before I proceed.    I understand that the default <code>SessionSecurityTokenHandler</code> uses DPAPI in combination with some identifier from the app pool for its cryptography, so it makes sense that this would happen in that case, but the behavior in <code>MachineKeySessionSecurityTokenHandler</code> puzzles me.  Is there still some identifier in the application that gets recreated on restart on which <code>MachineKeySessionSecurityTokenHandler</code> depends?  Am I just missing a setting?</p>
  
  <p>Here are the pertinent parts from my web.config:</p>
  
  <pre><code>&lt;configSections&gt;
    &lt;section name="system.identityModel"
             type="System.IdentityModel.Configuration.SystemIdentityModelSection, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089" /&gt;
  &lt;/configSections&gt;
  </code></pre>
  
  <p>...</p>
  
  <pre><code>&lt;system.identityModel&gt;
    &lt;identityConfiguration&gt;
      &lt;securityTokenHandlers&gt;
        &lt;remove type="System.IdentityModel.Tokens.SessionSecurityTokenHandler, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" /&gt;
        &lt;add type="System.IdentityModel.Services.Tokens.MachineKeySessionSecurityTokenHandler, System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" /&gt;
      &lt;/securityTokenHandlers&gt;
    &lt;/identityConfiguration&gt;
  &lt;/system.identityModel&gt;
  </code></pre>
  
  <p>...</p>
  
  <pre><code>&lt;system.web&gt;
    &lt;machineKey compatibilityMode="Framework45"
                validationKey="E27893..."
                decryptionKey="ABC..." 
                validation="SHA1" decryption="AES" /&gt;
    &lt;authentication mode="Forms"&gt;
    &lt;forms loginUrl="~/Account/Login"
           timeout="10080" /&gt;
    &lt;/authentication&gt;
  &lt;/system.web&gt;
  </code></pre>
  
  <p>...</p>
  
  <pre><code>&lt;system.webServer&gt;
    &lt;modules runAllManagedModulesForAllRequests="true"&gt;
      &lt;add name="SessionAuthenticationModule"
           type="System.IdentityModel.Services.SessionAuthenticationModule, System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" /&gt;
    &lt;/modules&gt;
  &lt;/system.webServer&gt;
  </code></pre>