# Login Security

**URL:** <https://forum.radzen.com/t/login-security/10356>\
**Category:** Blazor Server\
**Created:** [March 16, 2022, 7:12pm UTC](https://forum.radzen.com/t/login-security/10356 "2022-03-16T19:12:26Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![daveg1466](https://forum.radzen.com/user_avatar/forum.radzen.com/daveg1466/32/18767_2.png) [@daveg1466](https://forum.radzen.com/u/daveg1466)\
**Post date:** [March 16, 2022, 7:12pm UTC](https://forum.radzen.com/t/login-security/10356/1 "2022-03-16T19:12:26Z")

</div>

How can I require login everytime someone access my application. Current login setup keeps the user logged in even if they close the browser window. This is sometimes causing an issue with loading when a new windows is opened. I would like to make sure that a login is required no matter whether they just closed the browser or logged our correctly.

---

<div class="post-metadata">

**Author:** ![korchev](https://forum.radzen.com/user_avatar/forum.radzen.com/korchev/32/4_2.png) [@korchev](https://forum.radzen.com/u/korchev)\
**Post date:** [March 16, 2022, 7:52pm UTC](https://forum.radzen.com/t/login-security/10356/2 "2022-03-16T19:52:23Z")

</div>

We are using the following code to perform the login:

```auto
signInManager.PasswordSignInAsync(userName, password, false, false);

```

The argument (false) for the [third parameter](https://docs.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.identity.signinmanager-1.passwordsigninasync?view=aspnetcore-6.0) explicitly tells ASP.NET Identity not to persist the login cookie. This is also what we observe - after closing the browser the application redirects to the login page. In short we are not sure how or why the login could be persisted after closing the browser - this isn't the behavior that we observe in our tests.

---

<div class="post-metadata">

**Author:** ![daveg1466](https://forum.radzen.com/user_avatar/forum.radzen.com/daveg1466/32/18767_2.png) [@daveg1466](https://forum.radzen.com/u/daveg1466)\
**Post date:** [March 16, 2022, 9:51pm UTC](https://forum.radzen.com/t/login-security/10356/3 "2022-03-16T21:51:19Z")

</div>

Thank you for the quick response. I am not sure either. It is also happening during development on my local machine. I will continue to investigate.

---

<div class="post-metadata">

**Author:** ![daveg1466](https://forum.radzen.com/user_avatar/forum.radzen.com/daveg1466/32/18767_2.png) [@daveg1466](https://forum.radzen.com/u/daveg1466)\
**Post date:** [March 19, 2022, 10:55pm UTC](https://forum.radzen.com/t/login-security/10356/4 "2022-03-19T22:55:10Z")

</div>

I have rebuilt just the login and security portion of my application to test if I had some piece of code that is changing the persistance of the login and I found what may be the issue. I ran the application multiple times and was sent to login page every time. Then I closed the browser completely and opened it again to a different web application (tried a few different ones) then opened my Radzen application in a second tab. When I close the tab that the Radzen application is on, the login persists and I can't login again without logging out. I am not sure if this is a code issue or a browser issue, but wanted to let you know what I have found so far.

---

<div class="post-metadata">

**Author:** ![daveg1466](https://forum.radzen.com/user_avatar/forum.radzen.com/daveg1466/32/18767_2.png) [@daveg1466](https://forum.radzen.com/u/daveg1466)\
**Post date:** [March 19, 2022, 10:57pm UTC](https://forum.radzen.com/t/login-security/10356/5 "2022-03-19T22:57:13Z")

</div>

So it seems that if the browser does not completely close, the login persists and I have to close the browser completely to reset it.