title: How to Invalidate AspNetCore.Identity.Application Cookie after user log out
body: <p>I am having trouble invalidating .AspNetCore.Identity.Application cookie in ASP.NET Core Identity once the user log out.</p>
  <p>Once user clicks on log out below code will execute.</p>
  <pre><code>   public async Task&lt;IActionResult&gt; Logout(LogoutInputModel model)
      {
          // build a model so the logged out page knows what to display
          LoggedOutViewModel loggedOutViewModel = await BuildLoggedOutViewModelAsync(model.LogoutId);
  
          _logger.LogInformation($&quot;loggedOutViewModel : {JsonConvert.SerializeObject(loggedOutViewModel)}&quot;);
  
          if (User?.Identity.IsAuthenticated == true)
          {
              // delete local authentication cookie
              await _norskTakstSignInManager.SignOutAsync();
  
              //clear cookies
              var appCookies = Request.Cookies.Keys;
              foreach (var cookie in appCookies)
              {
                  Response.Cookies.Delete(cookie);
              }
  
              // raise the logout event
              await _events.RaiseAsync(new UserLogoutSuccessEvent(User.GetSubjectId(), User.GetDisplayName()));
          }
  
          // check if we need to trigger sign-out at an upstream identity provider
          if (loggedOutViewModel.TriggerExternalSignout)
          {
              // build a return URL so the upstream provider will redirect back
              // to us after the user has logged out. this allows us to then
              // complete our single sign-out processing.
              string url = Url.Action(&quot;Logout&quot;, new { logoutId = loggedOutViewModel.LogoutId });
  
              // this triggers a redirect to the external provider for sign-out
              return SignOut(new AuthenticationProperties { RedirectUri = url }, loggedOutViewModel.ExternalAuthenticationScheme);
          }
  
          return View(&quot;LoggedOut&quot;, loggedOutViewModel);
      }
  </code></pre>
  <p>This successfully clears all the cookies in the browser, however, if I grab the value of the cookie named &quot;.AspNetCore.Identity.Application&quot; prior to signing out, then add it back in on to the browser, then i can log in to the application without entering user credentials.</p>
  <p><a href="https://i.stack.imgur.com/MGyRy.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/MGyRy.png" alt="enter image description here" /></a></p>
  <p>I tested few flows setting up cookie expiration time in different ways but non of them seem to work correctly.</p>
  <p>I want to know way to invalidate the cookie without just clearing to resolve this issue.Then user should not be able to enter cookie manually and log in to the system.  Any help is hugly appreciated. Thank you.</p>