Argthtjtr

From the AD B2C sample from Microsoft, I was able to successfully login and log out of my own tenant in all browsers, except Edge, where logout is behaving oddly.

Problem: Upon logout in Edge and then a subsequent attempt at a new login, the browser gets quickly redirected to Azure and then the previous user seems to be auto logged in by Azure without prompt for credentials. This is obviously not what we want.

Effectively, logout doesn't seem to be successful at all in Edge, and we have to wait for the Azure session to timeout to try to login properly again. This is only happening in the deployed dev instance and not when running locally in Edge.

Question: Is there some workaround for getting complete logout to work in Edge? Why might I be experiencing this only in Edge?

Login Method:

public void Login( )

        {

            //Use the default policy (specified in Startup.Auth) to process the sign up / sign in flow

            if (!Request.IsAuthenticated)

            {

                HttpContext.GetOwinContext().Authentication.Challenge();

                return;

            }

            Response.Redirect("/");

        }

Logout Method:

/*

    *  Called when requesting to sign out

    */

    public void SignOut( )

    {

        // To sign out the user, you should issue an OpenIDConnect sign out request.

        if (Request.IsAuthenticated)

        {

            IEnumerable<AuthenticationDescription> authTypes = HttpContext.GetOwinContext().Authentication.GetAuthenticationTypes();

            HttpContext.GetOwinContext().Authentication.SignOut( authTypes.Select(t => t.AuthenticationType).ToArray());

        }

    }

I tried adding Session.RemoveAll();
Session.Abandon(); in the logout but that did not work.

The Startup method is as shown in the sample as well.

app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);



            app.UseCookieAuthentication(new CookieAuthenticationOptions());



            app.UseOpenIdConnectAuthentication(

...);

...

Please refer to the description on Azure Document:

When you want to sign the user out of the app, it is not enough to
clear your app's cookies or otherwise end the session with the user.
You must also redirect the user to Azure AD to sign out. If you fail
to do so, the user might be able to reauthenticate to your app without
entering their credentials again. This is because they will have a
valid single sign-on session with Azure AD.

So, you can simply redirect the user to the end_session endpoint:

GET https://fabrikamb2c.b2clogin.com/fabrikamb2c.onmicrosoft.com/oauth2/v2.0/logout?

p=b2c_1_sign_in

&post_logout_redirect_uri=https%3A%2F%2Faadb2cplayground.azurewebsites.net%2F

More details, please refer to Azure Active Directory B2C: Web sign-in with OpenID Connect