title: Make custom request when auth session is expired or user logged out
body: <p>In one MVC project, I implemented asp.net identity based on cookies. Now I have a requirement to make a request to remote service when auth session is expired or when user logged off.</p>
  
  <p>Is there any natural way to accomplish that? For now I managed to set two delegate properties from CookieAuthenticationProvider like below:</p>
  
  <pre><code>app.UseCookieAuthentication(new CookieAuthenticationOptions
          {
              AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
              LoginPath = new PathString("/Login"),
              CookieSecure = CookieSecureOption.SameAsRequest,
              ExpireTimeSpan = TimeSpan.FromMinutes(expireInMinutes),
              CookiePath = cookiePath,
              Provider = new CookieAuthenticationProvider
              {
                  OnValidateIdentity = c =&gt;
                  {
                      if (c.Properties.ExpiresUtc.HasValue &amp;&amp; c.Properties.ExpiresUtc.Value &lt; c.Options.SystemClock.UtcNow)
                      {
                          c.RejectIdentity();
                          c.Request.Context.Authentication.SignOut(DefaultAuthenticationTypes.ApplicationCookie);
  
                          return Task.FromResult(0);
                      }
  
                      if (c.Options.SlidingExpiration)
                      {
                          // Reissue the auth cookie
                      }
  
                      return Task.FromResult(0);
                  },
                  OnResponseSignOut = c =&gt;
                  {
                      // Make a custom request
                  }
              }
          });
  </code></pre>
  
  <p>At first glance it looks like it works but I don't like the idea of checking expiry date in here. Problem is that OnResponseSignOut is not called when auth cookie is simply expired but is called only when I explicitly call IAuthenticationManager.SignOut.</p>
  
  <p>Is creating a custom CookieAuthenticationProvider the best option in here, or maybe there is another clean and natural solution for that case?</p>