Logging Out With AspNet.Security.OpenIdConnect.Server (ASP.NET vNext)

Question

I am using Visual Studio 2015 Enterprise and ASP.NET vNext Beta8 to issue and consume JWT tokens as described here.

In our implementation we're storing some client details in Redis at token issuing time and we would like the flush this information when the user logs out.

My question is what is the best practices for logging out with OIDC?

While I could roll my own contoller for this purpose I couldn't help but notice Open ID Connect (OIDC) seems somewhat primed to handle this case. For example OIDC has an OnLogoutEndpoint handler and LogoutEndpointPath settings. But when I call the OIDC logout URI that handler appears to accept any random x-www-form-urlencoded form I throw at it and doesn't in any particular way seem to be demanding the presence of a token.

Any advice on proper OIDC logout practices would be very much appreciated.

Kévin Chalet · Accepted Answer · 2016-04-17 03:00:30Z

1

In AspNet.Security.OpenIdConnect.Server, the logic used for the logout endpoint is left as an exercise.

In this sample, it is implemented using an MVC 6 controller, where you're - of course - free to add custom logic to remove cached details from your Redis server.

[HttpPost("~/connect/logout")]
[ValidateAntiForgeryToken]
public async Task<IActionResult> Logout() {
    // When invoked, the logout endpoint might receive an unauthenticated request if the server cookie has expired.
    // When the client application sends an id_token_hint parameter, the corresponding identity can be retrieved using AuthenticateAsync.
    var identity = await HttpContext.Authentication.AuthenticateAsync(OpenIdConnectServerDefaults.AuthenticationScheme);

    // Remove the cached details here. If you need to determine
    // who's the authenticated user, you can use the identity variable.

    // Remove the authentication cookie and return the user to the client application.
    return SignOut("ServerCookie", OpenIdConnectServerDefaults.AuthenticationScheme);
}

You can also do something similar directly from the LogoutEndpoint event. Don't forget to call context.HandleResponse() to make sure the request is not intercepted by another middleware.

edited Apr 17, 2016 at 3:00

answered Dec 2, 2015 at 1:26

Kévin Chalet

42.3k8 gold badges130 silver badges143 bronze badges

Sign up to request clarification or add additional context in comments.

11 Comments

42vogons Over a year ago

thanks - just out of curiosity if I use the LogoutEndpoint event why is that endpoint event expecting a form, or more to the point, what is expected to be in that form?

Kévin Chalet Over a year ago

Using a POST request/form is not mandatory, you can also use a single GET request. I used a form here because I wanted to add anti-XSRF support to the logout endpoint, to prevent unwanted logout (the "superlogout" syndrome). Alternatively, you can also use id_token_hint for that: github.com/aspnet-contrib/AspNet.Security.OpenIdConnect.Server/…

Kévin Chalet Over a year ago

(FYI: starting with the next beta, we'll stop using JWT access tokens by default and go back to opaque tokens. See github.com/aspnet-contrib/AspNet.Security.OpenIdConnect.Server/… for more information)

42vogons Over a year ago

Ok, given that we're calling app.UseJwtBearerAuthentication will our OIDC implementation function as-is or will we need to turn some additional knobs to keep it working with JWT tokens?

Kévin Chalet Over a year ago

When migrating to beta5, your app will stop working if you don't fix it. Enabling JWT tokens will only require a line of code in the configuration delegate. That said, migrating to our new validation/introspection middleware will be the recommended approach.

|

Collectives™ on Stack Overflow

Logging Out With AspNet.Security.OpenIdConnect.Server (ASP.NET vNext)

1 Answer 1

11 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

11 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related