how to maintain application cookie/session lifetime under Application Gateway? Currently cookie/session only last 20 minutes

Hi Eugene,

Thank you for reaching out on Microsoft Q&A forum

To understand it better, we have some suggestion as below:

Gateway-managed cookies (ApplicationGatewayAffinity)

• These are used only for session affinity (sticky sessions) to route subsequent requests to the same backend server.
• Their lifetime is fixed and short (typically one day for managed cookies) and cannot be extended beyond what Azure allows.

Reference link for increasing connection timeout://free.blessedness.top/en-us/azure/application-gateway/configuration-http-settings?tabs=backendhttpsettings

Setting Cookie Lifetimes: If you are using Application Gateway for Containers, you might have the option to define a specific cookie name and lifetime in the RoutePolicy resource or IngressExtension. Here’s an example command to create a RoutePolicy with a cookie lifetime of 3600 seconds (1 hour):

apiVersion: alb.networking.azure.io/v1
kind: IngressExtension
metadata:
  name: session-affinity-ingress-extension
  namespace: test-infra
spec:
  backendSettings:
    - service: echo # replace with your service name
      sessionAffinity:
        affinityType: "application-cookie"
        cookieName: "yourCookieName"
        cookieDuration: 3600s

Cookie Rewrites: If you need to address the security attributes of cookies and ensure they are set properly (like Secure or HttpOnly), you can implement a rewrite rule in the Application Gateway to modify the cookie settings

Reference link:https://free.blessedness.top/en-us/azure/application-gateway/configuration-http-settings?tabs=backendhttpsettings

Application-Level Settings: Don’t forget to check if there are any settings at the application level that also manage cookie/session lifetimes. Sometimes, the application itself will have configurations that affect session expiration.

Hope you find this comment helpful, if yes, please “up-vote” for the information provided , this can be beneficial to community members.

Kindly let us know if you have any questions.

Thanks

You can still visit the below reference links for more understanding.

• Troubleshoot Azure Application Gateway session affinity issues
• Application Gateway for Containers session affinity overview
• Secure flag for Session Affinity cookie in Application Gateway

Thanks, Priya.

We are using AG for hosted web sites(multiple instances) , it is not container. Clearly the cookies are there, why AG can't use it and let use time out. The load balancer we use currently) doesn't have any issues. This should be common issues for AG, hope there is a good solution from AG team.

Eugene