Logging out all cookied users - asp.net

Question

I have an ASP.NET MVC5 app which used to have indefinite timeouts, so users weren't logged out until they actually clicked the 'log out' link. This was changed a few weeks back using the code below in Startup.Auth.cs
app.UseCookieAuthentication(new CookieAuthenticationOptions
{
AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
LoginPath = new PathString("/"),
ExpireTimeSpan = TimeSpan.FromMinutes(29),
SlidingExpiration =true
});
The problem is that there are users who were cookied before the change who still seem to be logged in. Is there a way of logging out these users without deploying a change to the app to store/check for an extra value in the cookie?

Answer 1

Best thing would be to introduce SecurityStamp validation. All your cookies already have a value that you can check against, and you don't really need to do much yourself. Add CookieAuthenticationProvider to your CookieAuthenticationOptions like this:
app.UseCookieAuthentication(new CookieAuthenticationOptions
{
AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
LoginPath = new PathString("/"),
ExpireTimeSpan = TimeSpan.FromMinutes(29),
SlidingExpiration = true,
Provider = new CookieAuthenticationProvider
{
// Enables the application to validate the security stamp when the user logs in.
// This is a security feature which is used when you change a password or add an external login to your account.
OnValidateIdentity = SecurityStampValidator.OnValidateIdentity<ApplicationUserManager, ApplicationUser>(
validateInterval: TimeSpan.FromMinutes(30),
regenerateIdentity: (manager, user) => user.GenerateUserIdentityAsync(manager)),
},
});
This SecurityStampValidator will cause the cookies to regenerate every 30 minutes. You can reduce the validation interval as required, but I don't recommend going too short intervals as it'll increase load on your DB. I usually use 10 minutes.
Unfortunately you'll still have to redeploy this change, but not much code for you to write :-)