This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
Hi all;
In my code I handle a DbUpdateConcurrencyException and for the case of updating a user's account, and the user no longer exists, I want to log them out - as they are no longer a valid user.
Granted, not a biggie because this should be rare and any page they try to go to will not accept them as they no longer have a claim. But its cleaner to log them out.
I can't use the SignInManager in Blazor. It requires a POST to LogOut.cshtml. So, what's my options?
thanks - dave
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(211.20000000000002, 61%, 30%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EBS%3C/text%3E%3C/svg%3E)
just create a logout razor page that calls:
_signInManager.SignOutAsync();
the via javascript interop redirect to the page
Bruce - according to Microsoft:
ASP.NET Core abstractions, such as SignInManager and UserManager, aren't supported in Razor components. For more information on using ASP.NET Core Identity with Blazor, see Scaffold ASP.NET Core Identity into a Blazor Server app.
So that won’t work.
that why its a separate razor page, not a blazor component. the blazor code redirects to the razor page, unloading the blazor app. the razor page logouts (deleting the login cookie) and redirects back to the blazor app. this time the blazor app loads as unauthenicated. this is the same approach used to login, that is redirect to login razor page, unloading the blazor app, and redirecting back and load the blazor app with the login cookie.
Ok, I'm not understanding something. How do I have a razor page that's not a Blazor page? And how does it access injected services if it's not a Blazor page?
thanks - dave
Bruce - as I have a number of MVC pages already under Areas/Identity for the Identity stuff, what if I added a page there that did this? Or does that open me up to the security issue which is why we have to do a POST to logout instead of a GET?
thanks - dave
@Bruce (SqlWork.com) , here's details about why accomplishing this via a GET is a bad idea. Which may mean it's impossible to do what I want.
Which may mean it's impossible to do what I want.
No. It's just basic HTTP. Create a component with an HTML form that posts to the logout Razor Page or MVC controller.
Modify the Logout Razor Page
[IgnoreAntiforgeryToken]
public class LogoutModel : PageModel
{
private readonly SignInManager<IdentityUser> _signInManager;
private readonly ILogger<LogoutModel> _logger;
public LogoutModel(SignInManager<IdentityUser> signInManager, ILogger<LogoutModel> logger)
{
_signInManager = signInManager;
_logger = logger;
}
public async Task<IActionResult> OnPost(string returnUrl = null)
{
await _signInManager.SignOutAsync();
_logger.LogInformation("User logged out.");
//if (returnUrl != null)
//{
// return LocalRedirect(returnUrl);
//}
//else
//{
// // This needs to be a redirect so that the browser performs a new
// // request and the identity for the user gets updated.
// return RedirectToPage();
//}
return Redirect("/");
}
}
Create a component that has an HTML from that posts to the Razor Page.
@page "/logout-component"
<PageTitle>logout Component</PageTitle>
<h3>logout Component</h3>
<form action="/Identity/Account/Logout" method="post">
<input type="submit" value="logout" />
</form>
@code {
}
I disabled the anti-forgery token for simplicity. Implementing an antiforgery token in Blazor Server is not straightforward due to no HTTP context. But you could create a secret that the Logout Razor Page can lookup.
you can use MVC if you want, the identity package uses razor pages because they can be compiled into a library. the package also decided to use a form post for logout, bur its safe to create a get logout page.