Logging out from ASP.NET Core app using ASP.NET Identity with remote app auth doesn't work

[mjrousos]

Using remote app auth to share identity between an ASP.NET and ASP.NET Core app during incremental migration works for solutions using ASP.NET Identity for auth except for attempting to logout from an ASP.NET Core-served page.

The problem is that logging out in MVC apps using Identity is usually done via a form post to a logout endpoint. But when the logout form comes from the ASP.NET Core app and the endpoint that is posted to comes from the ASP.NET app, the operations fails due to not having a valid anti-forgery field.

The 'MvcApp' and 'MvcCoreApp' in this repo's samples folder demonstrates this problem.

A workaround is to logout from a page served by the ASP.NET portion of the app, but a better user experience would be to be able to logout from any part of the site.

Exception:

System.Web.Mvc.HttpAntiForgeryException: The required anti-forgery form field "__RequestVerificationToken" is not present.

[HttpAntiForgeryException (0x80004005): The required anti-forgery form field "__RequestVerificationToken" is not present.]
   System.Web.Helpers.AntiXsrf.TokenValidator.ValidateTokens(HttpContextBase httpContext, IIdentity identity, AntiForgeryToken sessionToken, AntiForgeryToken fieldToken) +692
   System.Web.Helpers.AntiXsrf.AntiForgeryWorker.Validate(HttpContextBase httpContext) +128
   System.Web.Mvc.ControllerActionInvoker.InvokeAuthorizationFilters(ControllerContext controllerContext, IList`1 filters, ActionDescriptor actionDescriptor) +168
   System.Web.Mvc.Async.<>c__DisplayClass3_1.<BeginInvokeAction>b__0(AsyncCallback asyncCallback, Object asyncState) +1082
   System.Web.Mvc.Async.WrappedAsyncResultBase`1.Begin(AsyncCallback callback, Object state, Int32 timeout) +163
   System.Web.Mvc.Async.AsyncControllerActionInvoker.BeginInvokeAction(ControllerContext controllerContext, String actionName, AsyncCallback callback, Object state) +463
   System.Web.Mvc.<>c.<BeginExecuteCore>b__152_0(AsyncCallback asyncCallback, Object asyncState, ExecuteCoreState innerState) +48
   System.Web.Mvc.Async.WrappedAsyncVoid`1.CallBeginDelegate(AsyncCallback callback, Object callbackState) +73
   System.Web.Mvc.Async.WrappedAsyncResultBase`1.Begin(AsyncCallback callback, Object state, Int32 timeout) +163
   System.Web.Mvc.Controller.BeginExecuteCore(AsyncCallback callback, Object state) +787
   System.Web.Mvc.Async.WrappedAsyncResultBase`1.Begin(AsyncCallback callback, Object state, Int32 timeout) +163
   System.Web.Mvc.Controller.BeginExecute(RequestContext requestContext, AsyncCallback callback, Object state) +630
   System.Web.Mvc.<>c.<BeginProcessRequest>b__20_0(AsyncCallback asyncCallback, Object asyncState, ProcessRequestState innerState) +99
   System.Web.Mvc.Async.WrappedAsyncVoid`1.CallBeginDelegate(AsyncCallback callback, Object callbackState) +73
   System.Web.Mvc.Async.WrappedAsyncResultBase`1.Begin(AsyncCallback callback, Object state, Int32 timeout) +163
   System.Web.Mvc.MvcHandler.BeginProcessRequest(HttpContextBase httpContext, AsyncCallback callback, Object state) +544
   System.Web.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +1128
   System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep step) +220
   System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) +134

[OzBob]

This could be related to the work in this PR: #76

As per @twsouthwick recent Asp.Net Community Standup on Incremental Asp.net Core migration says "Recommended to set up auth on Asp.net core app directly".

'/Auth/Logout' endpoint could be your first Auth endpoint to migrate?

[bsulliva]

I'm getting the same error, The required anti-forgery cookie "__RequestVerificationToken" is not present., for all form posts that occur on the .Net Core site. Any ideas on the issue?

[mjrousos]

A work-around here would be to have any sign out buttons/links from the ASP.NET Core app navigate the user to a dedicated sign out page served by the ASP.NET app. That does require changing the current app's user experience a bit, though, which isn't ideal.

To actually fix this, the most promising approach might be adding a backchannel mechanism for the ASP.NET Core app to communicate cookie sign-out requests to the ASP.NET app. This would be similar to how sign-in works and would help both Identity and OIDC scenarios.

An alternative would be making it possible to share anti-forgery tokens between the apps but that's likely more complicated.

[HaoK]

Samples updated by #121