title: WIF Security Token Caching
body: <p>I have a site that is a relying party to our WIF-based custom STS.  We recently implemented a Security Token Cache as described here: <a href="https://stackoverflow.com/questions/8015542/azure-web-farm-ready-securitytokencache">Azure/web-farm ready SecurityTokenCache</a>.  The major difference between our implementation and the one described in that link is that we use Azure AppFabric Caching as the backing store for the durable cache, rather than table storage.  This helped to relieve us of a token truncation issue on certain browsers but has introduced a new problem (We see the truncation problem primarily on pages that have google analytics + antiforgery cookies in addition to the fedauth cookie).  We're now receiving the following exception several thousand times per day:</p>
  
  <pre><code>System.IdentityModel.Tokens.SecurityTokenException
  ID4243: Could not create a SecurityToken. A token was not found in the token cache and no cookie was found in the context.
  
  System.IdentityModel.Tokens.SecurityTokenException: ID4243: Could not create a       SecurityToken. A token was not found in the token cache and no cookie was found in the context.
     at Microsoft.IdentityModel.Tokens.SessionSecurityTokenHandler.ReadToken(XmlReader reader, SecurityTokenResolver tokenResolver)
     at Microsoft.IdentityModel.Tokens.SessionSecurityTokenHandler.ReadToken(Byte[] token, SecurityTokenResolver tokenResolver)
     at Microsoft.IdentityModel.Web.SessionAuthenticationModule.ReadSessionTokenFromCookie(Byte[] sessionCookie)
     at Microsoft.IdentityModel.Web.SessionAuthenticationModule.TryReadSessionTokenFromCookie(SessionSecurityToken&amp; sessionToken)
     at Microsoft.IdentityModel.Web.SessionAuthenticationModule.OnAuthenticateRequest(Object sender, EventArgs eventArgs)
     at System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
     at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean&amp; completedSynchronously)
  </code></pre>
  
  <p>This exception seems to be happening in a redirect loop, so we'll see hundreds of them within a 1-2 minute time span.</p>
  
  <p>I've been unable to locate any useful information while researching the exception.  The only nugget that holds any hope so far is someone mentioning that it may be related to the cached object expiring prior to the session.</p>
  
  <p>We've been unable to reproduce the problem internally and only know it exists because of the thousands of entries filling up our Elmah tables.  Any help or insight would be very much appreciated.</p>
  
  <p>We pushed out what we thought may help resolve the problem (code below) but it had no effect:</p>
  
  <pre><code>HttpContext.Current.Response.Cookies.Remove("FedAuth");
  WSFederationAuthenticationModule authModule = FederatedAuthentication.WSFederationAuthenticationModule;
  string signoutUrl = (WSFederationAuthenticationModule.GetFederationPassiveSignOutUrl(authModule.Issuer, authModule.Realm, null));
  Response.Redirect(signoutUrl);
  </code></pre>