Auth Token in Web API

To achieve automatic logout in ASP.NET Identity when a user changes their password or their refresh token becomes invalid, you can follow these steps:

1. Implement a custom RefreshTokenProvider class that inherits from IAuthenticationTokenProvider. This class will handle the generation and validation of refresh tokens.

2. In the CreateAsync method of the RefreshTokenProvider class, generate a new refresh token and associate it with the user's identity. Store this refresh token in a secure location, such as a database.

3. In the ReceiveAsync method of the RefreshTokenProvider class, validate the incoming refresh token. If the token is valid, retrieve the associated user's identity and check if their password has been changed or if the refresh token has become invalid. If either condition is true, invalidate all existing refresh tokens for the user.

4. In your API controllers, whenever a user changes their password or their refresh token becomes invalid, call the InvalidateUserTokensAsync method of the UserManager class to invalidate all existing refresh tokens for the user.

Here's an example of how you can implement the RefreshTokenProvider class:

public class CustomRefreshTokenProvider : IAuthenticationTokenProvider
{
    public async Task CreateAsync(AuthenticationTokenCreateContext context)
    {
        // Generate a new refresh token
        var refreshToken = Guid.NewGuid().ToString("n");

        // Associate the refresh token with the user's identity
        context.Ticket.Properties.IssuedUtc = DateTime.UtcNow;
        context.Ticket.Properties.ExpiresUtc = DateTime.UtcNow.AddDays(30);
        context.Ticket.Properties.Dictionary["refreshToken"] = refreshToken;

        // Store the refresh token in a secure location
        // (e.g., database or distributed cache)
        await YourTokenStorageService.StoreRefreshTokenAsync(refreshToken, context.Ticket);
    }

    public async Task ReceiveAsync(AuthenticationTokenReceiveContext context)
    {
        // Validate the incoming refresh token
        var refreshToken = context.Token;
        var ticket = await YourTokenStorageService.RetrieveRefreshTokenAsync(refreshToken);

        if (ticket != null)
        {
            // Retrieve the associated user's identity
            var user = await YourUserManager.GetUserAsync(ticket.Identity);

            // Check if the user's password has been changed
            // or if the refresh token has become invalid
            if (user.PasswordChangedUtc > ticket.Properties.IssuedUtc ||
                !await YourTokenStorageService.IsRefreshTokenValidAsync(refreshToken))
            {
                // Invalidate all existing refresh tokens for the user
                await YourTokenStorageService.InvalidateUserTokensAsync(user.Id);
            }
        }
    }
}

To register the CustomRefreshTokenProvider class in your ASP.NET Identity configuration, add the following code in your Startup class:

public void ConfigureAuth(IAppBuilder app)
{
    // ...

    app.UseOAuthBearerTokens(new OAuthAuthorizationServerOptions
    {
        // ...

        RefreshTokenProvider = new CustomRefreshTokenProvider()
    });

    // ...
}