How to Logout of Owin Providers?

Try setting the cache control headers.

public ActionResult SignOut() {
    var authenticationTypes = new string[] {
        DefaultAuthenticationTypes.ApplicationCookie,  
        DefaultAuthenticationTypes.ExternalCookie 
    };
    AuthenticationManager.SignOut(authenticationTypes);
    // HACK: Prevent user from being able to go back to a logged in page once logged out
    Response.Cache.SetExpires(DateTime.UtcNow.AddMinutes(-1));
    Response.Cache.SetCacheability(HttpCacheability.NoCache);
    Response.Cache.SetNoStore();
    // now redirect
    return RedirectToAction("Index", "Home");    
}

private IAuthenticationManager AuthenticationManager {
    get {
        return Request.GetOwinContext().Authentication;
    }
}

There is no stopping the user clicking the back button on the browser, unless you try JavaScript, which can be disabled. The user can go back a page and view what was on the previous page, but if they try to click any protected links or refresh the page, they will be redirected to log in.


As mentioned in the tutorial, the middleWare used use the default authentication type but don't override it.

By using only externalCookie as parameter for Owin you are clearing the cookie for Asp, but not the one used to store the Google provider,

to do so, you will have to get the array of all current cookies. It can be done the easy way like this:

Request.GetOwinContext()
       .Authentication
       .SignOut(HttpContext.GetOwinContext()
                           .Authentication.GetAuthenticationTypes()
                           .Select(o => o.AuthenticationType).ToArray());

This is where it is said on the Tutorial:

The call to UseGoogleAuthentication should be quite obvious why it’s needed.

But the first one toSetDefaultSignInAsAuthenticationType is not as obvious. login middleware normally relies on the external cookie middleware registered before the social login middleware. external cookie middleware, it sets itself as the default signin type. That’s how the social login middleware knows that it should use the external cookie. In this setup there is no external cookie, so we have to manually set the main cookie middleware as the default signin type. The cookie middleware will only issue a cookie if the AuthenticationType matches the one in the identity created by the social login middleware.Looking at the owin external authentication pipeline a socialIn the setup of the