How can I logout (Identity) in code in a Blazor server app

Question

How can I logout (Identity) in code in a Blazor server app

David Thielen 3,231

Hi all;

In my code I handle a DbUpdateConcurrencyException and for the case of updating a user's account, and the user no longer exists, I want to log them out - as they are no longer a valid user.

Granted, not a biggie because this should be rare and any page they try to go to will not accept them as they no longer have a claim. But its cleaner to log them out.

I can't use the SignInManager in Blazor. It requires a POST to LogOut.cshtml. So, what's my options?

thanks - dave

0 comments

1 answer

Your answer

Answer 1

Bruce (SqlWork.com) 83,981

just create a logout razor page that calls:

_signInManager.SignOutAsync();

the via javascript interop redirect to the page

David Thielen 3,231 Reputation points

2023-05-26T15:08:56.5966667+00:00
Bruce - according to Microsoft:

ASP.NET Core abstractions, such as SignInManager and UserManager, aren't supported in Razor components. For more information on using ASP.NET Core Identity with Blazor, see Scaffold ASP.NET Core Identity into a Blazor Server app.

So that won’t work.

Dave
Bruce (SqlWork.com) 83,981 Reputation points

2023-05-26T15:31:03.05+00:00

that why its a separate razor page, not a blazor component. the blazor code redirects to the razor page, unloading the blazor app. the razor page logouts (deleting the login cookie) and redirects back to the blazor app. this time the blazor app loads as unauthenicated. this is the same approach used to login, that is redirect to login razor page, unloading the blazor app, and redirecting back and load the blazor app with the login cookie.
David Thielen 3,231 Reputation points

2023-05-26T19:09:55.1366667+00:00

Ok, I'm not understanding something. How do I have a razor page that's not a Blazor page? And how does it access injected services if it's not a Blazor page?

thanks - dave
David Thielen 3,231 Reputation points

2023-05-31T08:21:13.4233333+00:00

Bruce - as I have a number of MVC pages already under Areas/Identity for the Identity stuff, what if I added a page there that did this? Or does that open me up to the security issue which is why we have to do a POST to logout instead of a GET?

thanks - dave
David Thielen 3,231 Reputation points

2023-05-31T09:08:28.3633333+00:00

@Bruce (SqlWork.com) , here's details about why accomplishing this via a GET is a bad idea. Which may mean it's impossible to do what I want.

AgaveJoe 31,361

Which may mean it's impossible to do what I want.

No. It's just basic HTTP. Create a component with an HTML form that posts to the logout Razor Page or MVC controller.

Modify the Logout Razor Page

    [IgnoreAntiforgeryToken]
    public class LogoutModel : PageModel
    {
        private readonly SignInManager<IdentityUser> _signInManager;
        private readonly ILogger<LogoutModel> _logger;

        public LogoutModel(SignInManager<IdentityUser> signInManager, ILogger<LogoutModel> logger)
        {
            _signInManager = signInManager;
            _logger = logger;
        }
  
        public async Task<IActionResult> OnPost(string returnUrl = null)
        {
            await _signInManager.SignOutAsync();
            _logger.LogInformation("User logged out.");
            //if (returnUrl != null)
            //{
            //    return LocalRedirect(returnUrl);
            //}
            //else
            //{
            //    // This needs to be a redirect so that the browser performs a new
            //    // request and the identity for the user gets updated.
            //    return RedirectToPage();
            //}
            return Redirect("/");
        }
    }

Create a component that has an HTML from that posts to the Razor Page.

@page "/logout-component"

<PageTitle>logout Component</PageTitle>

<h3>logout Component</h3>

<form action="/Identity/Account/Logout" method="post">
    <input type="submit" value="logout" />
</form>

@code {

}

I disabled the anti-forgery token for simplicity. Implementing an antiforgery token in Blazor Server is not straightforward due to no HTTP context. But you could create a secret that the Logout Razor Page can lookup.

Bruce (SqlWork.com) 83,981 Reputation points

2023-05-31T16:09:17.8133333+00:00

you can use MVC if you want, the identity package uses razor pages because they can be compiled into a library. the package also decided to use a form post for logout, bur its safe to create a get logout page.

Share via

How can I logout (Identity) in code in a Blazor server app

1 answer

Your answer