Table of Contents

Sign out and revoke sessions

Last updated:

Use IPasswordSessionManager.SignOutAsync to revoke the session associated with the current ASP.NET Core request.

Prerequisites

  • The request runs through the Helium authentication pipeline.
  • Resolve IPasswordSessionManager from the request scope.
  • Pass the current HttpContext.

Sign out the current session

OperationResult result =
    await sessionManager.SignOutAsync(
        httpContext,
        cancellationToken);

A successful operation revokes the server-side session and clears the framework-managed authentication state for the response.

Account-wide revocation

The public sign-out operation targets the current session. Password reset and framework security invalidation revoke all existing sessions for the account. Consumers do not enumerate, mutate, or delete internal session rows.

Verify the result

After sign-out:

  1. issue a new request without reusing application test state;
  2. confirm IAuthenticatedAccountAccessor.Current is null;
  3. confirm protected operations return the application's unauthenticated outcome.

A replayed old cookie must not recreate an authenticated context.

Troubleshooting

When a browser still displays authenticated UI after sign-out, distinguish cached presentation from a new protected server request. Authorization decisions must rely on current server state.

Next steps

Review Authentication sessions and Identity security considerations.