|Microsoft Enterprise Library 5.0|
|Terminating a User Session (Expiring a Token)|
An example of when you may want to expire a token is when you want to make sure that the token cannot be used by an attacker after the user logs out. You can use the approach described here to expire a user principal or a user identity.
In this scenario, the goal is to make sure that the token corresponding to a user identity is expired.
Call the ExpireIdentity method on the security cache object. This expires the token corresponding to the specified identity.
The following code shows how to use the ExpireIdentity method. It assumes that you have resolved the ISecurityCacheProvider type through the Enterprise Library container to obtain an instance of the security cache provider you want to use, and stored the reference in a variable named secCache.
|For more information on instantiating objects, see Creating and Referencing Enterprise Library Objects.|
// Cache the identity (as shown in a previous scenario). IToken token = secCache.SaveIdentity(new GenericIdentity("Username")); // Expire the cached identity corresponding to the token. secCache.ExpireIdentity(token);
|Visual Basic||Copy Code|
' Cache the identity (as shown in a previous scenario). Dim token As IToken = secCache.SaveIdentity(New GenericIdentity("Username")) ' Expire the cached identity corresponding to the token. secCache.ExpireIdentity(token)
For information about resolving Enterprise Library objects in your applications, see Creating and Referencing Enterprise Library Objects.
Alternately, you can use the ExpirePrincipal or ExpireProfile methods to remove the principal (an object that implements the IPrincipal interface) or profile information (such as the ASP.NET Profile object) associated with a token from the cache.