How do you delete a cookie and log a user out from an oauth/external login eg. google/twitter

user_17209176 0
Viewed 342
public class User : ControllerBase 
{
   
    [HttpGet("GoogleSignIn")]
    public async Task GoogleSignIn()
    {
        await HttpContext.ChallengeAsync(GoogleDefaults.AuthenticationScheme,
            GetAuthenticationProperties());           
    }

    [HttpGet("FacebookSignIn")]
    public async Task FacebookSignIn()
    {
        await HttpContext.ChallengeAsync(FacebookDefaults.AuthenticationScheme,
            new AuthenticationProperties { RedirectUri = "/welcome" });
    }

    [HttpGet("TwitterSignIn")]
    public async Task TwitterSignIn()
    {
        await HttpContext.ChallengeAsync(TwitterDefaults.AuthenticationScheme,
             GetAuthenticationProperties());
    }

    [HttpGet("GitHubSignIn")]
    public IActionResult GitHubSignIn()
    {
         return Challenge(new AuthenticationProperties { RedirectUri = "/welcome" }, "Github");
    }

    public async Task DeleteCookie()
    {
        await HttpContext.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);
    }

    public AuthenticationProperties GetAuthenticationProperties()
    {
        return new AuthenticationProperties()
        {

            IsPersistent = true,
            ExpiresUtc = DateTime.Now.AddSeconds(5),
            RedirectUri = "/welcome",
        };
    }
}

Above is my code that I've tried. I found that the cookie does get deleted, but the user still remains logged in. Any help would be appreciated. Would I need to maybe use JWT to completely delete the user login since deleting the cookie is not sufficient.

blazor c#
1 Answers

Are you trying to log user out from your client or from the oauth service? Here is my used case (Blazor WASM) using AuthenticationStateProvider to listen to login and logout event at your client app level. i) CustomAuthStateProvider (extending AuthenticationStateProvider) 2) AccountService class - to serve login and logout, 3) JS Interop class, works with localstorage/session/cookies

You may have a different approach on login and localstorage. But here is my flow using JWT and sample of Custom Authentication State handlings.

Login:

  1. In Account service, authenticate user login request
  2. If login successful, pass the claims to OnSuccessfulLogin method which will then notify AuthenticationState to update your web app "authentication status"
  3. call JS Interop method to store JWT token in localstorage

Logout

  1. call JS Interop to remove JWT token

  2. call OnLogout to clear authentication state

     public void OnSuccessfulLogin(IEnumerable<Claim> claims)
 {
     var identity = new ClaimsIdentity(claims, "OAuth");

     claimsPrincipal = new ClaimsPrincipal(identity);
     NotifyAuthenticationStateChanged(GetAuthenticationStateAsync());
 }

 public void OnLogout()
 {
     claimsPrincipal = new(new ClaimsIdentity());
     NotifyAuthenticationStateChanged(GetAuthenticationStateAsync());
 }
user_169451200
Related