Table of Contents

Class LogoutModel

Namespace
Fdyay.IdentityServer.UI.Pages.Account
Assembly
Fdyay.IdentityServer.UI.dll

The sign-out page: asks a signed-in user to confirm, and signs them out on the post.

public class LogoutModel : PageModel, IAsyncPageFilter, IPageFilter, IFilterMetadata
Inheritance
LogoutModel
Implements
Inherited Members

Constructors

LogoutModel(IIdentityServerInteractionService, ISignOutService, IOptions<IdentityServerOptions>)

Creates the page model, as the container resolves it.

public LogoutModel(IIdentityServerInteractionService interaction, ISignOutService signOut, IOptions<IdentityServerOptions> options)

Parameters

interaction IIdentityServerInteractionService

Reads the sign-out the logout id describes, and creates one when there is none.

signOut ISignOutService

Ends the session and notifies its clients.

options IOptions<IdentityServerOptions>

The server options; UserInteraction.LogoutIdParameter names the logout id's query parameter.

Properties

Input

The posted form: the logout id.

[BindProperty]
public LogoutModel.InputModel Input { get; set; }

Property Value

LogoutModel.InputModel

LogoutContext

The sign-out the logout id describes, read on the GET.

public LogoutRequest LogoutContext { get; set; }

Property Value

LogoutRequest

Methods

OnGetAsync()

Asks the user to confirm. A GET never ends the session — that is the CSRF hole.

public Task<IActionResult> OnGetAsync()

Returns

Task<IActionResult>

Remarks

The id is read by the configured name. LogoutIdParameter decides what the end-session endpoint and the SAML single logout endpoint put on the redirect, so a page binding logoutId saw nothing at any other value — and a client-initiated sign-out then arrived at a page that believed nobody had asked for it, dropping the post-logout redirect the client had supplied.

The route values handed to the signed-out page below stay spelled logoutId deliberately. That link is this assembly's own, written here and read there, so it is not a name a host configures — the option governs what the protocol endpoints emit. The same is true of the external-login page's returnUrl, which is both a page-to-page link and an authentication-properties key.

OnPostAsync()

Signs a signed-in user out through ISignOutService, capturing the session as a logout id first when the form carries none, then sends the browser to the signed-out page — by way of the upstream provider's own sign-out when the session began there.

public Task<IActionResult> OnPostAsync()

Returns

Task<IActionResult>

A redirect to the signed-out page, or the upstream sign-out.