Owin身份验证cookie在第一个请求之后不可见

Question

使用Microsoft Owin v3的MVC 5应用程序通过Windows Azure Active Directory对用户进行身份验证。我有一个我不完全理解的登录过程。我希望在每次请求时看到一个cookie，我只能在登录后在登录页面上看到一个cookie。导航到另一个控制器后，cookie消失，但会话似乎已正确验证。有谁知道这是如何工作的？这是我在逻辑上的标志......我没有看到任何浏览器中设置了到期时间的cookie。我看到.AspNet.Cookies，__ RequestVerificationToken和2个与支持实用程序相关的cookie。使用Firebug删除任何这些对用户会话没有影响，我仍然保持登录状态。

HttpContext.GetOwinContext().Authentication.Challenge(
                new AuthenticationProperties { RedirectUri = "/", IsPersistent = true, AllowRefresh = true, ExpiresUtc = DateTime.UtcNow.AddMinutes(20) }, 
                OpenIdConnectAuthenticationDefaults.AuthenticationType
            );

这是从在线示例中获取的启动逻辑......

public void ConfigureAuth(IAppBuilder app)
    {
        //TODO: Use the Ioc container to get this but need to check if the kernel has been created before this runs
        string applicationClientId = ConfigurationManager.AppSettings.Get(ConfigurationConstants.AppSettings.AzureApplicationClientId);

        //fixed address for multitenant apps in the public cloud
        string authority = "https://login.windows.net/common/";

        app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);

        app.UseCookieAuthentication(new CookieAuthenticationOptions { CookieDomain = "example.com" });

        app.UseOpenIdConnectAuthentication(
            new OpenIdConnectAuthenticationOptions
            {
                ClientId = applicationClientId,
                Authority = authority,
                TokenValidationParameters = new System.IdentityModel.Tokens.TokenValidationParameters
                {
                    // instead of using the default validation (validating against a single issuer value, as we do in line of business apps), 
                    // we inject our own multitenant validation logic
                    ValidateIssuer = false,
                },
                Notifications = new OpenIdConnectAuthenticationNotifications()
                {

                    RedirectToIdentityProvider = (context) =>
                    {
                        // This ensures that the address used for sign in and sign out is picked up dynamically from the request
                        // this allows you to deploy your app (to Azure Web Sites, for example)without having to change settings
                        // Remember that the base URL of the address used here must be provisioned in Azure AD beforehand.
                        string appBaseUrl = context.Request.Scheme + "://" + context.Request.Host + context.Request.PathBase;
                        context.ProtocolMessage.RedirectUri = appBaseUrl;
                        //This will need changing to the web site home page once it is live
                        context.ProtocolMessage.PostLogoutRedirectUri = "http://www.example.com";
                        return Task.FromResult(0);
                    },
                    // we use this notification for injecting our custom logic
                    SecurityTokenValidated = (context) =>
                    {
                        // retriever caller data from the incoming principal
                        string issuer = context.AuthenticationTicket.Identity.FindFirst("iss").Value;
                        string UPN = context.AuthenticationTicket.Identity.FindFirst(ClaimTypes.Name).Value;
                        string tenantId = context.AuthenticationTicket.Identity.FindFirst("http://schemas.microsoft.com/identity/claims/tenantid").Value;

                        //Todo - fetch the tenant info

                        //if ((db.Tenants.FirstOrDefault(a => ((a.IdentityProvider == issuer) && (a.ActiveDirectoryTenantId == tenantId))) == null))
                        //    // the caller wasn't from a trusted issuer throw to block the authentication flow
                        //    throw new SecurityTokenValidationException();
                        return Task.FromResult(0);
                    },
                    AuthenticationFailed = (context) =>
                    {
                        context.OwinContext.Response.Redirect("/Home/Error");
                        context.HandleResponse(); // Suppress the exception
                        return Task.FromResult(0);
                    }
                }
            });

    }