Add logout to Identity API endpoints
- Dominant language
- C#
- Stars
- 38.4k
- Forks
- 10.9k
- Avg merge
- 2d 5h
- Merged PRs (30d)
- 276
Description
### Is there an existing issue for this?
- [X] I have searched the existing issues
### Is your feature request related to a problem? Please describe the problem.
We are building a SPA application using the new Identity API endpoints. As per recommendations for single-origin scenarios, we're using cookies rather than tokens, i.e. calling the `/login` endpoint with `?useCookies=true`. In this scenario, the user logging out is mostly a matter of deleting the authentication cookie.
However, Identity provides no API endpoint to do this, which seems like an omission to us.
So we have to either:
- Add a custom endpoint that clears the cookie
- Clear the cookie directly in the browser using front-end code
Here's an example workaround we're currently doing for lack of better options:
```cs
app.MapIdentityApi();
app.MapPost("/logout", async (SignInManager signInManager) =>
{
await signInManager.SignOutAsync().ConfigureAwait(false);
});
```
### Describe the solution you'd like
The Identity API endpoints (mapped using `MapIdentityApi()`) should really include a `POST /logout` endpoint. This endpoint should invoke all the relevant server-side identity events related to logging out, and should also clear any authentication cookie from the client browser.
### Additional context
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.