1

I am developing a REST API with .NET Core 6 using an OAuth 2 authentication. I need a login which does:

  • authenticate the user using the REST API
  • issue a (user-specific) token I can use in the web application (ArcGIS API for Javascript)

For this, I am using AspNet.Security.OAuth.ArcGIS and basically the Server-Enabled Workflow. Everything works fine until I sign out.

When I sign out, the cookie is removed and I have no access to REST API any more. So far so good but the access_token is not invalidated. I can still use the token to access ArcGIS web services.

I understand that there is no logout option available with AspNet.Security.OAuth.ArcGIS. So I was looking into alternative ways how to invalidate the token:

How can I invalidate an access_token?

Some of the resources I used:

Improve this question
2
  • Have you posted to the Esri forums? You may grab the attention of a developer over there?
    – KHibma
    Jul 18, 2022 at 16:11
  • No I haven't yet. I don't really like using Esri's community forum. Their editor is horrific to use and I usually avoid their forum unless it's really important. However, since I don't get response here, I will consider it. Thanks for reminding me. I went with a workaround and I use a proxy endpoint to funnel all UI requests for the ArcGIS REST API. That way I don't have to expose a token.
    – Thomas
    Aug 2, 2022 at 19:41

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.