SignOutAsync（）不注销用户

Question

I have a MVC app that has a couple of WebAPI endpoints. The reason for this is we have an app that should be able to communicate with the application. For authentication, I am using Identity.

After I logged in and want to log out again, it works in the UI. So I implemented the same logic in the Logout actions in one of my API endpoints:

public async Task<JsonResult> LogOut()
{
    await _signInManager.SignOutAsync();            
    _logger.LogInformation("User logged out.");

    return new JsonResult(new { Anything = "Logout successful." });
}

I also tried most of the approaches I found here when I search for the same question. However, no matter what I do, the cookie ".AspNetCore.Identity.Application" is always in the next request and I am still authenticated.

I am using Postman to test the API endpoints, if that makes any difference.

Answer 1

Right now you only have cookie authentication and when you call SignOutAsync() a response is being generated which indicates to delete the authentication cookie and in response to that browser deletes the authentication cookie so in the next call there is no cookie and you are not logged in anymore but if you store the authentication cookie before sign out and then add it to the browser after you sign out you are still logged in because your credential is in the cookie.

So this is how browser behaves, and you don't have this behaviour in postman or HttpClient .

Your options are to either use Reference Token for your apis

or

You can config a Session Store with your Cookie Authentication