the "/logout" handler in the document does nothing.

[BigSquareHasNoEdge]

Description

Hello.

I have followed the example codes and found the "/logout" does nothing.

api.MapGet("/secret", 
    (ClaimsPrincipal user) =>
        Results.Text($"{user.Identity?.Name ?? "unknown user"}, I am your father.")
    )
    .RequireIdentityTokenAuthorization();  // policy based Auth

// ...

api.MapPost("/logout",
    async ([FromBody]object empty, SignInManager<ApplicationUser> signInManager) => 
    {
        if(empty is not null)
        {
            await signInManager.SignOutAsync();
            return Results.Ok();
        }

        return Results.BadRequest();
    })
    .RequireIdentityTokenAuthorization(); // policy base auth.

after POST to logout, GET secret with the access token still worked, while I didn't expected it would.

Page URL

https://learn.microsoft.com/en-us/aspnet/core/security/authentication/identity-api-authorization?view=aspnetcore-8.0#use-the-post-refresh-endpoint

Content source URL

https://github.com/dotnet/AspNetCore.Docs/blob/main/aspnetcore/security/authentication/identity-api-authorization.md

Document ID

137d4b94-7b26-3911-b22d-42c754a95fc1

Article author

@tdykstra