ASP.NET MVC 5 Owin Identity got lost before allowed ExpiresUtc

Question

public void ConfigureAuth(IAppBuilder app)
{
    app.UseKentorOwinCookieSaver(PipelineStage.Authenticate);
    app.UseCookieAuthentication(new CookieAuthenticationOptions
            {
                AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
                LoginPath = new PathString("/Login"),
                LogoutPath = new PathString("/Logout"),
                CookieSecure = CookieSecureOption.SameAsRequest ,
                SlidingExpiration = true,
                CookieName = ".app",
                CookieHttpOnly = true,
                CookiePath = "/",
                CookieDomain = Domain
            });

My sign in method:

private void IdentitySignin(AppUserState appUserState, bool isPersistent = false)
{
    var Browser = Request.Browser + Request.Browser.Version;

    var claims = new List<Claim>
            {
                // create required claims
                new Claim(ClaimTypes.NameIdentifier, appUserState.UserId),
                new Claim(ClaimTypes.Name, appUserState.Name),
                new Claim(ClaimTypes.Role, appUserState.RoleName),
                new Claim(ClaimTypes.UserData, Browser.GetHashCode().ToString()),

                // User State Info
                new Claim("userState", appUserState.ToString())
            };

    var identity = new ClaimsIdentity(claims, DefaultAuthenticationTypes.ApplicationCookie);

    AuthenticationManager.SignIn(new AuthenticationProperties()
            {
                AllowRefresh = true,
                IsPersistent = isPersistent,
                //Dictionary = { { "RememberMe", isPersistent ? "true" : "false" } },
                ExpiresUtc = isPersistent ? DateTime.UtcNow.AddHours(3) : DateTime.UtcNow.AddMinutes(20)
            }, identity);
}

I'm expecting that cookie should be alive for 3 hours, but it expires after less than 15 minutes.

It works as expected on local, but this happens only when i deploy to IIS.

1. Should I set asp.net session timeout to be same as expiration timeout?
2. Should I include any other IIS configuration?

Answer 1

After long research, I found that I have to add the following line to my web.config file

<system.web>
   <sessionState mode="StateServer" timeout="1200" cookieless="false" />
</system.web>