ASP.NET Core 2.1 - 身份验证 cookie 已删除，但用户仍然可以登录而无需重定向到外部登录

Question

再会！我目前正在创建一个网站，该网站利用 Google 身份验证来实现内容个性化。我在登录和检索登录用户信息方面没有问题，但当我调用 SignOutAsync() 函数时，.NET 并未完全注销用户，因为用户再次单击“登录”按钮时可以立即登录。清除浏览器缓存后，用户单击“登录”按钮时将被重定向到 Google 登录页面。

Startup.cs 中的服务配置：

public void ConfigureServices(IServiceCollection services)
    {
        services.Configure<CookiePolicyOptions>(options =>
        {
            // This lambda determines whether user consent for non-essential cookies is needed for a given request.
            options.CheckConsentNeeded = context => true;
            options.MinimumSameSitePolicy = SameSiteMode.None;
        });

        // Configure authentication service
        services.AddAuthentication(options =>
        {
            options.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme;
            options.DefaultSignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
            options.DefaultChallengeScheme = "Google";
        })
            .AddCookie("Cookies")
            .AddGoogle("Google", options =>
            {
                options.ClientId = Configuration["Authentication:Google:ClientId"];
                options.ClientSecret = Configuration["Authentication:Google:ClientSecret"];
            });

        services.AddSingleton<IHttpContextAccessor, HttpContextAccessor>();
        services.AddSingleton<IRecommender, OntologyRecommender>();

        services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_2_1);
    }

Startup.cs 中的中间件配置：

public void Configure(IApplicationBuilder app, IHostingEnvironment env)
    {
        if (env.IsDevelopment())
        {
            app.UseDeveloperExceptionPage();
        }
        else
        {
            app.UseExceptionHandler("/Home/Error");
            app.UseHsts();
        }

        app.UseHttpsRedirection();
        app.UseStaticFiles();
        app.UseCookiePolicy();
        app.UseAuthentication();

        app.UseMvc(routes =>
        {
            routes.MapRoute(
                name: "default",
                template: "{controller=Home}/{action=Index}/{id?}");
        });
    }

UserController.cs 中的登录操作：

 public IActionResult Login()
    {
        return Challenge(new AuthenticationProperties() { RedirectUri = "/" });
    }

UserController.cs 中的注销操作：

[HttpPost]
    [ValidateAntiForgeryToken]
    public async Task<IActionResult> Logout()
    {   
        await HttpContext.SignOutAsync();
        HttpContext.Response.Cookies.Delete(".AspNetCore.Cookies");
        return RedirectToAction("Index", "Home");
    }

我是 ASP.NET Core 身份验证领域的新手，所以如果有人能在这件事上帮助我，我将不胜感激，谢谢！

Answer 1

您需要循环访问应用程序 cookie - 这是一个示例代码片段：

if (HttpContext.Request.Cookies[".MyCookie"] != null)
{
    var siteCookies = HttpContext.Request.Cookies.Where(c => c.Key.StartsWith(".MyCookie"));
    foreach (var cookie in siteCookies)
    {
        Response.Cookies.Delete(cookie.Key);
    }
}