如果用戶保存其 cookie、注銷，然后將其 cookie 導入回瀏覽器，則他們將成功登錄。我怎樣才能SigninManager殺死他們的會話服務器端呢？我讀過有關放棄的內容，但似乎不可用。這是我的代碼：await _signInManager.SignOutAsync();
HttpContextAccessor httpCon = new HttpContextAccessor();
httpCon.HttpContext.Session.Clear();
1 回答
溫溫醬
TA貢獻1752條經驗 獲得超4個贊
這是正常的過程。要在注銷后使身份 cookie 失效，您可以SecurityStamp按照以下步驟更新并檢查它：
CustomCookieAuthenticationEvents
public class CustomCookieAuthenticationEvents : CookieAuthenticationEvents
{
private readonly SignInManager<IdentityUser> _signInManager;
public CustomCookieAuthenticationEvents(SignInManager<IdentityUser> signInManager)
{
// Get the database from registered DI services.
_signInManager = signInManager;
}
public override async Task ValidatePrincipal(CookieValidatePrincipalContext context)
{
var userPrincipal = context.Principal;
var user = await _signInManager.ValidateSecurityStampAsync(userPrincipal);
if (user == null)
{
context.RejectPrincipal();
await context.HttpContext.SignOutAsync(
IdentityConstants.ApplicationScheme);
}
}
}
注冊并配置CustomCookieAuthenticationEvents
services.AddDefaultIdentity<IdentityUser>()
.AddRoles<IdentityRole>()
.AddEntityFrameworkStores<ApplicationDbContext>();
services.ConfigureApplicationCookie(options =>
{
options.EventsType = typeof(CustomCookieAuthenticationEvents);
});
services.AddScoped<CustomCookieAuthenticationEvents>();
退出流程
await _signInManager.SignOutAsync();
var user = await _userManager.GetUserAsync(User);
await _userManager.UpdateSecurityStampAsync(user);
_logger.LogInformation("User logged out.");
- 1 回答
- 0 關注
- 118 瀏覽
添加回答
舉報
0/150
提交
取消