asp.net mvc 5 - Signing out External Cookies before Signing in ApplicationCookie - OWIN -
I am currently studying the new ASPNET identity and owin authentication so that I can customize it for my own use . I just created a default MVC 5 application and it came to this part of the code
private async Task Sign InSync (ApplicationUser user, bool isPersistent) {AuthenticationManager.SignOut (DefaultAuthenticationTypes.ExternalCookie); /// Why?? Var identification = UserManager Wait for credentials async (user, default authentication.tap.exe); Authentication Manager Signin (new authentication credentials) (IDresistent = identifiers}, identification);
Question
Is there a security risk to leave the external cookie?
This indicates that the purpose of that line is to disable the external cookie that is available from the third party provider I went. Since the user has to transfer the identity of the user from third parties to local identity.
Not doing this keeps cookies valid even after the user is signed out.
Comments
Post a Comment