How to revoke a session token via ASP.NET Identity 2?

This Security.StackExchange answer explains why and when the current session token needs to be revoked. My question is, how can I revoke a session token via ASP.NET Identity 2?

Here's a relevant quote from the above answer. The original question asked if, when registering a new user, the email should be checked (by clicking the link in the email sent to the email address provided by the user) followed by a password based login.

You should revoke the session token and generate a new one when the user goes to the first step of the registration process. This ensures that if the session was committed, an attacker would then not be able to start the logged on session. If you want additional security to re-enter them in your password, you must update the session token in the first step and after confirming the link.

+3


source to share





All Articles