I am developing a REST API with .NET Core 6 using an OAuth 2 authentication. I need a login which does:

  • authenticate the user using the REST API
  • issue a (user-specific) token I can use in the web application (ArcGIS API for Javascript)

For this, I am using AspNet.Security.OAuth.ArcGIS and basically the Server-Enabled Workflow. Everything works fine until I sign out.

When I sign out, the cookie is removed and I have no access to REST API any more. So far so good but the access_token is not invalidated. I can still use the token to access ArcGIS web services.

I understand that there is no logout option available with AspNet.Security.OAuth.ArcGIS. So I was looking into alternative ways how to invalidate the token:

How can I invalidate an access_token?

Some of the resources I used:

  • Have you posted to the Esri forums? You may grab the attention of a developer over there?
    – KHibma
    Jul 18, 2022 at 16:11
  • No I haven't yet. I don't really like using Esri's community forum. Their editor is horrific to use and I usually avoid their forum unless it's really important. However, since I don't get response here, I will consider it. Thanks for reminding me. I went with a workaround and I use a proxy endpoint to funnel all UI requests for the ArcGIS REST API. That way I don't have to expose a token.
    – Thomas
    Aug 2, 2022 at 19:41


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.