All 15 Authentication questions
More in Authentication
How does JWT bearer authentication validate an incoming token, and what claims does TokenValidationParameters check? How do external identity provider integrations (like Google or Microsoft Entra ID) work using OAuth/OpenID Connect authentication handlers? How do refresh tokens work alongside short-lived JWT access tokens, and how would you implement a refresh endpoint? How do you implement API key authentication as a custom authentication scheme for machine-to-machine API access? How does Windows Authentication (Negotiate/Kerberos) work in ASP.NET Core for intranet applications, and when is it appropriate? How would you implement passwordless authentication (like a magic link sent via email) in ASP.NET Core?
Advertisement
ASP.NET Core › Authentication

How would you implement sign-out that properly invalidates both a cookie session and any associated server-side state?

Advanced

Answer

HttpContext.SignOutAsync(scheme) clears the authentication cookie on the client side, but for schemes needing genuine server-side invalidation (like revoking an active session token stored in a database or cache, important if you want immediate cross-device logout), you must also explicitly remove or mark that server-side record as invalid -- otherwise a copied/stolen cookie captured before sign-out could theoretically still be replayed if your validation doesn't check server-side revocation state.
public async Task<IActionResult> Logout() {
    var sessionId = User.FindFirst("sid")?.Value;
    await _sessionStore.RevokeAsync(sessionId);  // server-side invalidation
    await HttpContext.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);  // clears the cookie
    return RedirectToPage("/Index");
}
Real-world example A banking application's logout flow both clears the client cookie AND revokes the corresponding server-side session record, ensuring a captured cookie from before logout can't be replayed to regain access after the user explicitly signed out.

Common follow-ups: How would you validate server-side session revocation on every subsequent request without excessive database load?;What's the difference between this and simply relying on short cookie expiration?

Sessions Cookies & TempData;Caching
All 15 Authentication questions