SignalR use old cookie after user logged in.

Is there an existing issue for this?

• I have searched the existing issues

Describe the bug

I use cookie based authentication on ASP.NET 6.0.0 SPA template. Start hub as below.

    this.connection = new HubConnectionBuilder()
      .withUrl(`${setting.baseUrl}/hub/store`)
      .build();
    await this.connection.start();

And I logged in on action controller as below. I skip password verification. This is just example.

   [HttpPost]
     public async Task<ActionResult> Login(LoginModel model)
     {
         

         var user = await userManager.FindByNameAsync(model.Username);

         if (user is null)
         {
             user = new ApplicationUser();

             await userManager.SetUserNameAsync(user, model.PublicKey);
             var createResult = await userManager.CreateAsync(user);

             if (!createResult.Succeeded)
                 return BadRequest(createResult);
         }

         var claims = new List<Claim> { new Claim(ClaimTypes.NameIdentifier, user.Id) };
         var claimsIdentity = new ClaimsIdentity(claims, CookieAuthenticationDefaults.AuthenticationScheme);

         var authProperties = new AuthenticationProperties
         {
             IsPersistent = true,
             ExpiresUtc = DateTime.UtcNow.AddDays(15)
         };

         await HttpContext.SignInAsync(CookieAuthenticationDefaults.AuthenticationScheme, new ClaimsPrincipal(claimsIdentity), authProperties);

         await storeHub.Clients.User(user.Id).LoggedIn();

         return Ok();
     }

As you can see i push LoggedIn message for the logged in user at the end of login method.

I call the endpoint by ajax request and i see that LoggedIn message is not triggered on client side. It is also not triggered on other opened tabs as well.

SignalR is set it up correctly because after i refresh page then i am able to get messages from SignalR.

It seems that SignalR client use older cookie still after user logged in.

Expected Behavior

I expect that when user logged in via ajax call then SignalR should be able to get messages.

Also other opened tabs should get messages as well without refreshing.

This is not limited to ajax call. Other tabs doesn’t get messages until refreshed.

Steps To Reproduce

No response

Exceptions (if any)

No response

.NET Version

6.0.100

Anything else?

.NET SDK (reflecting any global.json): Version: 6.0.100 Commit: 9e8b04bbff

Runtime Environment: OS Name: Windows OS Version: 10.0.22000 OS Platform: Windows RID: win10-x64 Base Path: C:\Program Files\dotnet\sdk\6.0.100\

Host (useful for support): Version: 6.0.0 Commit: 4822e3c3aa

.NET SDKs installed: 2.1.818 [C:\Program Files\dotnet\sdk] 3.1.415 [C:\Program Files\dotnet\sdk] 6.0.100 [C:\Program Files\dotnet\sdk]

.NET runtimes installed: Microsoft.AspNetCore.All 2.1.30 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All] Microsoft.AspNetCore.App 2.1.30 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App] Microsoft.AspNetCore.App 3.1.21 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App] Microsoft.AspNetCore.App 6.0.0 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App] Microsoft.NETCore.App 2.1.30 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App] Microsoft.NETCore.App 3.1.21 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App] Microsoft.NETCore.App 6.0.0 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App] Microsoft.WindowsDesktop.App 3.1.21 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App] Microsoft.WindowsDesktop.App 6.0.0 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]

To install additional .NET runtimes or SDKs: https://aka.ms/dotnet-download

[YakupIpek]

So you have connected clients and are updating the cookie after they are connected?

Other clients has to restart page or connection in order to be connected with new cookie.

The already connected clients are going to have the user ID of whatever your previous cookie had and wont see the new cookie until they are reconnected.

If so there is nothing to do

[adityamandaleeka]

Closing since this is by design.