如果用戶保存其 cookie、注銷，然后將其 cookie 導(dǎo)入回瀏覽器，則他們將成功登錄。我怎樣才能SigninManager殺死他們的會(huì)話服務(wù)器端呢？我讀過有關(guān)放棄的內(nèi)容，但似乎不可用。這是我的代碼：await _signInManager.SignOutAsync();
HttpContextAccessor httpCon = new HttpContextAccessor();
httpCon.HttpContext.Session.Clear();
1 回答
溫溫醬
TA貢獻(xiàn)1752條經(jīng)驗(yàn) 獲得超4個(gè)贊
這是正常的過程。要在注銷后使身份 cookie 失效，您可以SecurityStamp按照以下步驟更新并檢查它：
CustomCookieAuthenticationEvents
public class CustomCookieAuthenticationEvents : CookieAuthenticationEvents
{
private readonly SignInManager<IdentityUser> _signInManager;
public CustomCookieAuthenticationEvents(SignInManager<IdentityUser> signInManager)
{
// Get the database from registered DI services.
_signInManager = signInManager;
}
public override async Task ValidatePrincipal(CookieValidatePrincipalContext context)
{
var userPrincipal = context.Principal;
var user = await _signInManager.ValidateSecurityStampAsync(userPrincipal);
if (user == null)
{
context.RejectPrincipal();
await context.HttpContext.SignOutAsync(
IdentityConstants.ApplicationScheme);
}
}
}
注冊(cè)并配置CustomCookieAuthenticationEvents
services.AddDefaultIdentity<IdentityUser>()
.AddRoles<IdentityRole>()
.AddEntityFrameworkStores<ApplicationDbContext>();
services.ConfigureApplicationCookie(options =>
{
options.EventsType = typeof(CustomCookieAuthenticationEvents);
});
services.AddScoped<CustomCookieAuthenticationEvents>();
退出流程
await _signInManager.SignOutAsync();
var user = await _userManager.GetUserAsync(User);
await _userManager.UpdateSecurityStampAsync(user);
_logger.LogInformation("User logged out.");
- 1 回答
- 0 關(guān)注
- 165 瀏覽
添加回答
舉報(bào)
0/150
提交
取消