ASP.NET Core MVC Interview Question #108

How do you sign a user out of an MVC application?

Authentication, Authorization, Security & State Management Mid-Level Intermediate

Quick Interview Answer

Signing out removes or invalidates the authentication session for the specified scheme. With cookie authentication, SignOutAsync causes the authentication cookie to be removed from the response.

Detailed Explanation

Signing out removes or invalidates the authentication session for the specified scheme. With cookie authentication, SignOutAsync causes the authentication cookie to be removed from the response.

Applications using ASP.NET Core Identity should generally use SignInManager.SignOutAsync so sign-out follows the Identity configuration.

Code Example

[HttpPost]
[ValidateAntiForgeryToken]
public async Task<IActionResult> Logout()
{
    await HttpContext.SignOutAsync("AppCookie");
    return RedirectToAction("Index", "Home");
}