Interface ISignOutService

Namespace: Fdyay.IdentityServer.Services

Assembly: Fdyay.IdentityServer.AspNetCore.dll

Ends the local session and tells everyone who needs to know that it ended.

public interface ISignOutService

Remarks

Ours, not Duende's — there the equivalent sequence is driven by middleware that intercepts the sign-out, so a host never names it. It exists here because this server ends a session from two places that are not each other's callers: the logout page's POST, and the end-session endpoint answering a relying party. A session ended from one of them had to be indistinguishable from a session ended from the other, and for four releases it was not: the endpoint dropped the cookie and told nobody.

So the sequence lives in one place rather than in two that have to be remembered together. A host that replaces the shipped logout page needs exactly this, and previously had to reproduce it.

Methods

SignOutAsync(HttpContext, string?, CancellationToken)

Ends the session in the browser, then notifies the clients named by logoutId.

Task<string?> SignOutAsync(HttpContext context, string? logoutId, CancellationToken cancellationToken = default)

Parameters

context HttpContext: The request whose session is ending.
logoutId string: A logout id created before the session ends. It is the only place the session's client list survives sign-out, so a caller that creates it afterwards has nobody to notify — which is not an error this can report, because a session that reached no client looks the same.
cancellationToken CancellationToken: Cancels the notification, not the sign-out.

Returns