使用Angular WebApi注销：错误选项

Question

When I disconnect with my angular application through my WebApi my request is rejected during the call OPTIONS

I use OpenIddict and Asp.Net core 2.2 , and I call this method

[HttpGet("~/connect/logout")]
public async Task<IActionResult> Logout()
{
    await _signInManager.SignOutAsync();
    return SignOut(OpenIddictServerDefaults.AuthenticationScheme);
}

I have this error

info: Microsoft.AspNetCore.Hosting.Internal.WebHost[1] Request starting HTTP/1.1 OPTIONS http://localhost:44300/connect/logout fail: OpenIddict.Server.Internal.OpenIddictServerHandler[0] The logout request was rejected because an invalid HTTP method was specified: OPTIONS. info: OpenIddict.Server.Internal.OpenIddictServerHandler[0] The logout response was successfully returned as a plain-text document: { "error": "invalid_request", "error_description": "The specified HTTP method is not valid." }.

I have no problem with my other APIs

Answer 1

The fact an OPTIONS request is sent - most likely a preflight CORS request in this case - makes me think you tried to use the logout endpoint as an "API endpoint", something it's not made for.

Pretty much like the authorization endpoint, the logout endpoint is an interactive endpoint, designed to be used with good old redirects, and optionally a consent screen, to inform the user he or she's about to be logged out (and thus, prevent unwanted logouts, that are usually seen as targeted "DOS" attacks).

Assuming you don't want a consent screen, consider sending the logout request in a hidden iframe, instead of using XMLHttpRequest.