Asp.net core 5 Identity SignOutAsync does not work

Question

I am using the Asp.Net core Identity framework (v5.0) in a razor website. The following section is in startup.cs

services.AddIdentity<IdentityUser, IdentityRole>(options =>
            { 
                options.Password.RequiredLength = 8;
                options.Password.RequireDigit = true;
                options.Password.RequireLowercase = true;
                options.Password.RequireUppercase = true;
                options.Password.RequireNonAlphanumeric = true;

                options.Lockout.AllowedForNewUsers = true;
                options.Lockout.MaxFailedAccessAttempts = 5;
                options.Lockout.DefaultLockoutTimeSpan = new TimeSpan(0, 0, 5, 0);

                options.SignIn.RequireConfirmedEmail = false;
            })

All works fine, but when I logout the user, the client side cookie is deleted but server side the session is still open.

So when I capture the http request to one of the pages that needs authentication, logoff the user and later replay the captured request the page loads instead of a logon request.

Due to security requirements this is not usable.

I simplified the logoff code to this

@page
@using Microsoft.AspNetCore.Identity
@inject SignInManager<IdentityUser> SignInManager


@functions
{
    public async Task<IActionResult> OnGet()
    {
        if(SignInManager.IsSignedIn(User))
        {
            await SignInManager.SignOutAsync();
        }
        return RedirectToPage();
    }
}

which corresponds to Microsofts documentation

I tried some solutions using context.SignOutAsync described here but the httpcontext does not contain a SignOutAsync method. (Maybe this is because that uses an older version)

Is there a way to close the server side session?

Answer 1

Was looking for something else but it looks like you're trying to sign the user out when the page loads which may be causing it to not remove session. You should use onPost from a loaded page. If you use the _LoginPartial you can handle the signout from there. I've tested that as working.