Logout mechanism not fully effective

Question

We are using Sitecore 9.3. We have login and logout features in our site using Azure AD B2C.

During logout, we are performing below operations in that order -

1. AuthenticationManager.Logout()
2. We send request to Azure AD B2C to logout and send a post logout redirect url
3. Delete the cookie - .AspNet.Cookie
4. Calling HttpContext.Current.Session.Abandon()
5. Calling HttpContext.Current.Session.Clear()
6. Calling Request.GetOwinContext().Authentication.SignOut()

In the penetration test done on the site, it was found that even after logging out, calling - https://portalname/sitecore/api/ssc/item/{item_id}/children

with .ASPNet.Cookies in the header is giving 200 OK response.

Can anyone please suggest why is application still accepting the value of .AspNet.Cookies cookie? How to prevent this behavior?

Answer 1

You need to send a sign-out request to Azure AD B2C because you are "only" logging out user from Sitecore. Upon a sign-out request, Azure AD B2C invalidates the Azure AD B2C cookie-based session, and attempts to sign out from federated identity providers.

You can do it by sending GET request to this url:

https://{tenant}.b2clogin.com/{tenant}.onmicrosoft.com/{policy}/oauth2/v2.0/logout?post_logout_redirect_uri=https%3A%2F%2Fjwt.ms%2F

You can find more information here -> https://learn.microsoft.com/en-us/azure/active-directory-b2c/openid-connect#send-a-sign-out-request