How to remove cookies asp.net core authorization

Question

If I delete a user that has cookie based authorization, the will still have access to the system until he presses the logout button. Or until the cookie expires.

How to fix the situation.

Answer 1

This is a general problem of claims based authentication when removing access for users. Due to how it is designed, the database is not accessed on every request to verify the access. Instead, the cryptographically signed cookie is considered to be the source of truth. So when the access is removed in the database, the cookie is still valid and it is not trivial how to update the user's cookie in that case. Since it is a cookie that is stored on the client side, you also can't just log out the user remotely.

But there is a mechanism in ASP.NET Core Identity that enforces the cookie authentication scheme to re-validate an identity on a certain interval. You can configure this like this in your Startup 's ConfigureServices method:

services.Configure<SecurityStampValidatorOptions>(options =>
{
     options.ValidationInterval = TimeSpan.FromMinutes(10);
});

This would set the interval to 10 minutes. So every 10 minutes, a user accessing your site with an existing cookie would be validated, and a new cookie would be issued. This process is completely silent and happens behind the scenes.

Depending on how strictly you want to enforce this, you would have to lower this interval further. I would generally recommend you to still leave it at a certain duration. Otherwise you are defeating the purpose of the cached identity.

You should also consider how problematic it really is if a user still has access to your site, and how time critical a user removal would have to be. Depending on your application, it's also not unlikely that you retrieve the user entity within your critical actions anyway, so this would automatically fail in this case, without you having to deny access by removing the cookie.