UseGoogleAuthentication强制登录会话过期？

Question

我使用的是带有GoogleOAuth2AuthenticationOptions的ASP.NET MVC5的外部认证中间件UseGoogleAuthentication/UseExternalSignInCookie。有没有办法强制用户在每次访问该网站时都必须重新向Google进行身份验证？

目前，如果用户已经登录到Google并访问该站点，则无需重新向Google进行身份验证。理想情况下，分配的cookie只对他们在站点上的当前会话有好处……

    app.UseExternalSignInCookie(DefaultAuthenticationTypes.ExternalCookie);

    var authOptions = new GoogleOAuth2AuthenticationOptions();
    authOptions.ClientId = AppSettingsHelper.GoogleClientId;
    authOptions.ClientSecret = AppSettingsHelper.GoogleClientSecret;
    authOptions.CallbackPath = new PathString("/account/linklogincallback");

    foreach (var scope in AppSettingsHelper.GoogleOAuthScope)
    {
        authOptions.Scope.Add(scope);
    }
    app.UseGoogleAuthentication(authOptions);

Answer 1

将app.UseExternalSignInCookie(DefaultAuthenticationTypes.ExternalCookie);替换为app.UseCookieAuthentication(..)并指定ExpireTimeSpan。UseExternalSignInCookie只是使用某些默认值的cookie身份验证方法的帮助器。

app.UseCookieAuthentication(new CookieAuthenticationOptions
{
    AuthenticationType = DefaultAuthenticationTypes.ExternalCookie,
    SlidingExpiration = true,
    ExpireTimeSpan = new System.TimeSpan(0, 5, 0),
    LoginPath = new PathString("/Account/Login")
});

注意，我们在这里使用的是DefaultAuthenticationTypes.ExternalCookie而不是ApplicationCookie