I have a question that I have not been able to find an answer to. I'll do my best to explain. It is easily reproduced with an empty MVC 5 project using ASP.Net Identity for user authentication.
If I create a new MVC 5 application using ASP.NetIdentity 2, the default ConfigureAuth method in Startup.Auth.cs does not specify an ExpireTimeSpan value.
app.UseCookieAuthentication(new CookieAuthenticationOptions
{
AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
LoginPath = new PathString("/Account/Login"),
Provider = new CookieAuthenticationProvider
{
// Enables the application to validate the security stamp when the user logs in.
// This is a security feature which is used when you change a password or add an external login to your account.
OnValidateIdentity = SecurityStampValidator.OnValidateIdentity<ApplicationUserManager, ApplicationUser>(
validateInterval: TimeSpan.FromMinutes(30),
regenerateIdentity: (manager, user) => user.GenerateUserIdentityAsync(manager))
}
});
As I understand it, if I want a user to be logged out after a period of inactivity, this is where it is to be configured. So, for sake of example, I will set ExpireTimeSpan to 1 minute.
app.UseCookieAuthentication(new CookieAuthenticationOptions
{
AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
LoginPath = new PathString("/Account/Login"),
ExpireTimeSpan = TimeSpan.FromMinutes(1),
Provider = new CookieAuthenticationProvider
{
// Enables the application to validate the security stamp when the user logs in.
// This is a security feature which is used when you change a password or add an external login to your account.
OnValidateIdentity = SecurityStampValidator.OnValidateIdentity<ApplicationUserManager, ApplicationUser>(
validateInterval: TimeSpan.FromMinutes(30),
regenerateIdentity: (manager, user) => user.GenerateUserIdentityAsync(manager))
}
});
This works fine and I am correctly redirected to /Account/Login when trying to navigate after the session expires. However, if the first thing the user attempts after the session expires is to click the "Log off" link, the user is redirected to the Login view with a return URL for the LogOff view in the account controller. There is no GET method for LogOff. Therefore, if the user doesn't notice the return URL in the browser and attempts to log in at a later time, the redirect will produce an HTTP 404 for the /Account/LogOff.
It seems like this should be a common scenario and be handled easily. However, I don't see a way to handle it without changing the way login/logoff works in ASP.Net Identity. I've read the reasons for implementing log off as a post instead of a get and I understand that. I've also seen mention of a Katana bug that may have been slightly related but it has been closed.
I would appreciate any insight from someone who may have addressed this.
Thanks,
Keith