title: RememberMe with DotNetOpenId in ASP.NET MVC
body: <p>Using DotNetOpenAuth 3 in ASP.NET MVC and implementing a RememberMe facility ... </p>
  
  <p>I'm finding that even if I set createPersistentCookie to true in FormsAuthentication.RedirectFromLoginPage and FormsAuthentication.SetAuthCookie the user is not remembered <em>once the ASP.NET session times out</em>.</p>
  
  <p>If I inspect the cookie I find it is marked as persistent and does have an expiry date way in the future, I assume because I set my web.config FORMS timeout to a few years away. Anyhow, if the user closes the browser and re-opens it they are remembered correctly - as long as the ASP session hasn't timed out.</p>
  
  <p><a href="http://www.hanselman.com/blog/WeirdTimeoutsWithCustomASPNETFormsAuthentication.aspx" rel="noreferrer">An older post</a> of Scott Hanselmann's makes me wonder if it is because FormsAuthentication tries to renew the authentication ticket and maybe in an OpenId model that doesn't work but I have set FORMS SlidingExpiration="false" in web.config and anyway I thought that forcing a persistent cookie would make that stuff irrelevant.</p>
  
  <p>I'm also wondering why the DotNetOpenId MVC sample doesn't include a RememberMe checkbox - maybe there's something tricky about it?</p>
  
  <p>On the other hand, here at StackOverflow I see I am automatically remembered across sessions. Wondering whether they used something other than DotNetOpenId to do their OpenId authentication.</p>
  
  <p>Anybody else done RememberMe successfully with DotNetOpenId in ASP.NET MVC? Any tricks?</p>
  
  <p>[Update]</p>
  
  <p>Thanks for trying to help, Andrew. Turns out this was not about DotNetOpenId.</p>
  
  <p>I gather, after reading <a href="http://www.codeproject.com/KB/aspnet/machineKey.aspx" rel="noreferrer">this</a>, that my hosting provider is probably recycling the app pool regularly and that's causing the authentication ticket encryption to be done with a new machine key.</p>
  
  <p>As per the preceding linked article I added the following under System.Web in my Web.Config and it resolved the issue:</p>
  
  <pre><code>&lt;machineKey
      validationKey="(generated a new key to place here)"     
      decryptionKey="(generated a new key to place here)"
      validation="SHA1"
      decryption="AES" /&gt;
  </code></pre>