title: OWIN OpenId Authentication - Active Session after logout
body: <p>I have implemented the mix of ASP.Net Cookie Authentication &amp; OWIN OpenId authentication in my application. I am trying to fix a security flaw where the session is not invalidating even after logout.</p>
  <p>Middleware Implementation:</p>
  <pre>app.UseCookieAuthentication(
      new CookieAuthenticationOptions
      {
          AuthenticationType = CookieAuthenticationDefaults.AuthenticationType,    
          app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
          {
              ClientId = clientId,
              Authority = authority,
          }
       }
  );
  </pre>
  <p>Log Out Code (Based on user type):</p>
  <pre><code>HttpContext.GetOwinContext().Authentication.SignOut(
      OpenIdConnectAuthenticationDefaults.AuthenticationType,
      CookieAuthenticationDefaults.AuthenticationType);
      
  HttpContext.GetOwinContext().Authentication.SignOut(
      CookieAuthenticationDefaults.AuthenticationType);
  </code></pre>
  <p>I am capturing the traffic in <em>Fiddler</em> and clicking sign-out from web page. When I try to re-issue the request from Fiddler, it's completing successfully and in HttpModule, the <code>Application.User.Identity.IsAuthenticated</code> is <strong>True</strong></p>
  <p>I have a couple of questions:-</p>
  <ol>
  <li>Is this s Cookie replay attack?</li>
  <li>What I am doing wrong, if not I will
  have to fix it by some hack, like storing a cookie in the cache and
  comparing it?</li>
  </ol>