title: Web API 2, OWIN Authentication, SignOut doesn't logout
body: <p>I'm doing some research for work with a view to using Bearer tokens as an authentication mechanism (i.e. AngularJS UI, authenticates via OWIN in a Web API [2] project).</p>
  
  <p>I have the login working fine, role information and all that is fine, but I cannot get the token to logout.</p>
  
  <p>My startup configuration is this:</p>
  
  <pre><code>OAuthOptions = new OAuthAuthorizationServerOptions() {
      TokenEndpointPath = new PathString("/Token"),
      Provider = new ApplicationOAuthProvider(PublicClientId),
      AccessTokenExpireTimeSpan = SESSION_TIMEOUT,
      AllowInsecureHttp = true
  };
  </code></pre>
  
  <p>And my logout action is simply this:</p>
  
  <pre><code>public HttpResponseMessage Logout() {
      var authentication = HttpContext.Current.GetOwinContext().Authentication;
      authentication.SignOut(DefaultAuthenticationTypes.ExternalBearer);
  
      return new HttpResponseMessage(HttpStatusCode.OK);
  }
  </code></pre>
  
  <p>I've left all the authentication stuff out for brevity, but to confirm I am using <strong>ExternalBearer</strong> when setting up the token.</p>
  
  <p>In my UI I'm storing the token in local storage (no cookies are involved here, which is a deliberate design decision).  So I have a <strong>logout</strong> button on my UI, the <strong>Logout</strong> action is hit and the code runs fine.  </p>
  
  <p>However if I subsequently hit the an action on the API which requires authorisation, the request still goes through (i.e. the user is still authenticated even though they <em>should</em> have been signed out.</p>
  
  <p>Either I'm missing something really obvious (wouldn't be the first time ;-) or there's something more fundamental going on here - finally I'm pinging @leastprivilege as I know this is their area.</p>
  
  <p>Any help or insight would be gratefully received.</p>
  
  <hr>
  
  <p>Only thing I can think of is that the token is stateless on the server/API side and hence can't be expired or signed out.  </p>
  
  <p>If that is the case I guess I could either:</p>
  
  <p>a) Add a refresh token which creates a new token that expires in the past - would this even work? - actually cancel that, it would issue a new token ... the old one would still be valid</p>
  
  <p>b) Store the bearer token in the database and check each time, removing the token on logout (naturally salted, hashed, etc).  However this is just bringing us back to having a stateful server.</p>
  
  <p>c) I can (and will) be removing the token from local storage when someone explicitly logs out, however the token is still technically valid if <em>a baddy</em> can intercept the token.  Naturally all the above will be over <strong>SSL</strong> anyway, which should inhibit the <em>bad guys/girls</em>.</p>
  
  <p>d) Perhaps this is why lots of people are storing the Bearer token in a cookie (as a storage mechanism) so once you logout as least the cookie will be removed on the next refresh.</p>
  
  <p><em>Sorry the above is a bit of a brain dump, just wanting to pre-empt any questions</em></p>