Force expiration of authentication token

Question

I've spent a week now securing my Web API, creating custom filters and uses of authentication tokens. My problem now was when I'm requesting in my Web API using POSTMAN and the user was already sign out I can still get values from my API.

How can i manage to force expire my access token? Or is there other way to manage this kind of situation?

NOTE: When I'm requesting using POSTMAN, I copied my access token from the local storage.

Update:

This is what i followed in creating access token. http://www.asp.net/web-api/overview/security/individual-accounts-in-web-api

I tried the same situation as mine to the downloaded solution, still my access token is authenticated

Answer 1

You need to remove the cookies and the session if sign out is not doing that.

FormsAuthentication.SignOut();
Session.Abandon();

// clear authentication cookie
HttpCookie cookie1 = new HttpCookie(FormsAuthentication.FormsCookieName, "");
cookie1.Expires = DateTime.Now.AddYears(-1);
Response.Cookies.Add(cookie1);

// clear session cookie (not necessary for your current problem but i would recommend you do it anyway)
HttpCookie cookie2 = new HttpCookie("ASP.NET_SessionId", "");
cookie2.Expires = DateTime.Now.AddYears(-1);
Response.Cookies.Add(cookie2);

FormsAuthentication.RedirectToLoginPage();

Refrence Taken from here

Answer 2

As per http://www.asp.net/web-api/overview/security/individual-accounts-in-web-api

In this article all the details regarding authorization token is stored on session along with cookies. So you have two ways to sort out this.

1. Clear all the session and cookies on the logout.

2. You can also make a custom autorization filter and generate custom access token and store them to local file or database with the timeout limit. On logout you can clear tokens as per the user.

here is an example, how to set custom filters in web api 2.

 public class CustomAuthenticateAttribute : Attribute, IAuthenticationFilter
    {

        public async Task AuthenticateAsync(HttpAuthenticationContext context, CancellationToken cancellationToken)
        {
            HttpRequestMessage request = context.Request;
            AuthenticationHeaderValue authorization = request.Headers.Authorization;

            if (authorization == null)
                return;

            if (authorization.Scheme != "Bearer")
                return;

            if (String.IsNullOrEmpty(authorization.Parameter))
            {
                context.ErrorResult = new AuthenticationFailureResult("Missing token", request);
                return;
            }

            TokenL1 tokenL1;
            var validateToken = TokenHelper.DecryptToken(authorization.Parameter, out tokenL1);
            if (!validateToken)
            {
                context.ErrorResult = new AuthenticationFailureResult("Token invalid", request);
                return;
            }
            if (!(tokenL1.tokenexpiry > DateTime.Now))
            {
                context.ErrorResult = new AuthenticationFailureResult("Token expire", request);
                return;
            }
            IPrincipal principal = new GenericPrincipal(new GenericIdentity(tokenL1.email), new string[] { "user" });

            if (principal == null)
            {
                context.ErrorResult = new AuthenticationFailureResult("Invalid token", request);
                return;
            }
            else
            {
                context.Principal = principal;
            }
        }

        public Task ChallengeAsync(HttpAuthenticationChallengeContext context, CancellationToken cancellationToken)
        {
            var challenge = new AuthenticationHeaderValue("Bearer");
            context.Result = new AddChallengeOnUnauthorizedResult(challenge, context.Result);
            return Task.FromResult(0);
        }
        public bool AllowMultiple
        {
            get { return false; }
        }
    }

use this custom filer on the actionresult of a controller like this

[CustomAuthenticate]
public ActionResult Index()
{
return View();
}