小编Ytr*_*amX的帖子

我有一个OWIN中间件用于身份验证.我们有两种类型的身份验证.第一种类型是使用以下配置的承载令牌

var OAuthOptions =  new OAuthAuthorizationServerOptions
    {
        AuthenticationType = DefaultAuthenticationTypes.ExternalBearer,
        TokenEndpointPath = new PathString("/Token"),
        Provider = new ApplicationOAuthProvider(PublicClientId),
        AccessTokenExpireTimeSpan = TimeSpan.FromDays(14),
        AllowInsecureHttp = true,
        AccessTokenFormat = new SecureTokenFormatter(GetMachineKey())
    };

第二种类型使用身份验证cookie进行外部登录

app.UseCookieAuthentication(new CookieAuthenticationOptions
{
    AuthenticationType = DefaultAuthenticationTypes.ExternalCookie,
    AuthenticationMode = Microsoft.Owin.Security.AuthenticationMode.Passive,
    CookieHttpOnly = true,
    CookieSecure = CookieSecureOption.SameAsRequest,
    CookieName = ".AspNet." + DefaultAuthenticationTypes.ExternalCookie,
    ExpireTimeSpan = TimeSpan.FromMinutes(5),
    TicketDataFormat = new SecureTokenFormatter(GetMachineKey())
});

当用户注销时,我们实际发出了两个Logout

Request.GetOwinContext().Authentication.SignOut(DefaultAuthenticationTypes.ExternalCookie);

和

Request.GetOwinContext().Authentication.SignOut(DefaultAuthenticationTypes.ExternalBearer);

对于第一个,我希望看到从浏览器中删除.AspNet.ExternalCookie Cookie,但事实并非如此.对于第二个,我希望我的令牌失效,而User.Current.Identity = null,这不是.

那么我怎么能1)以物理方式注销当前会话的当前身份？2)从浏览器中删除外部Cookie？