title: Identity Framework Users Intermittently Logged Out
body: <p>I have been having issues where users will sometimes be logged before they should have reached timeout, sometimes just a few minutes after logging in.  It worked fine in lower environment until we got to prod.  Users are launching the site in a Citrix IE app.  I'm using ASP.NET MVC 5 with Identity Framework.  Here is how I'm setting up the auth cookie:</p>
  
  <pre><code>app.UseCookieAuthentication(new CookieAuthenticationOptions
  {
      AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
      LoginPath = new PathString("/Authentication/Index"),
      ExpireTimeSpan = TimeSpan.FromHours(4),
      SlidingExpiration = true,
      Provider = new CookieAuthenticationProvider()
      {
          OnValidateIdentity = SecurityStampValidator.OnValidateIdentity&lt;ApplicationUserManager, ApplicationUser&gt;(
              TimeSpan.FromSeconds(5),
              (manager, user) =&gt; user.GenerateUserIdentityAsync(manager))
      }
  });
  </code></pre>
  
  <p>In the web.config I have session state configured as InProc with a timeout of 240 minutes.  IIS is configured to only restart the site at 1am and to shutdown worker processes if it's been idle for 2 hours.  The site is hosted on a single server with failover to a secondary server.  I've validated in the IIS logs that we've never hit the secondary server.  I also have logging turned on all the logging for IIS recycles to make sure a recycle isn't occurring.  I was using the standard AuthorizeAttribute but am now inheriting from it to provide some logging for when the problem occurs.  In my log I see that .AspNet.ApplicationCookie is created when users login but is gone when the error occurs but I do see other cookies.  </p>
  
  <p>I've been googling it for a couple hours and can't find anything that matches.  What would cause this cookie to be deleted?</p>
  
  <p><strong>EDIT:</strong>
  Here is what is in the web.config</p>
  
  <pre><code>&lt;sessionState mode="InProc" customProvider="DefaultSessionProvider" timeout="240"&gt;
  </code></pre>