dotnet / dotnet/aspnetcore

Add logout to Identity API endpoints

Open
#52,834 7 comments 20 reactions 0 assignees View on GitHub
area-identity enhancement feature-identity-apis
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 5h
Merged PRs (30d)
276

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Is your feature request related to a problem? Please describe the problem.

We are building a SPA application using the new Identity API endpoints. As per recommendations for single-origin scenarios, we're using cookies rather than tokens, i.e. calling the `/login` endpoint with `?useCookies=true`. In this scenario, the user logging out is mostly a matter of deleting the authentication cookie.

However, Identity provides no API endpoint to do this, which seems like an omission to us.

So we have to either:
- Add a custom endpoint that clears the cookie
- Clear the cookie directly in the browser using front-end code

Here's an example workaround we're currently doing for lack of better options:

```cs
app.MapIdentityApi();
app.MapPost("/logout", async (SignInManager signInManager) =>
{
await signInManager.SignOutAsync().ConfigureAwait(false);
});
```

### Describe the solution you'd like

The Identity API endpoints (mapped using `MapIdentityApi()`) should really include a `POST /logout` endpoint. This endpoint should invoke all the relevant server-side identity events related to logging out, and should also clear any authentication cookie from the client browser.

### Additional context

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.