title: Logout implementation within web api application
body: <p>I have implemented <code>Login</code> and <code>Logout</code> actions in my web api controller like this </p>
  
  <p><strong>Login</strong></p>
  
  <pre><code>   [HttpPost] 
          [Route("Login")]
          public IHttpActionResult LoginUser(LoginUserBindingModel model)
          {
               var request = HttpContext.Current.Request;
              var tokenServiceUrl = request.Url.GetLeftPart(UriPartial.Authority) + request.ApplicationPath + "/Token";
              using (var client = new HttpClient())
              {
                  var requestParams = new List&lt;KeyValuePair&lt;string, string&gt;&gt;
              {
                  new KeyValuePair&lt;string, string&gt;("grant_type", "password"),
                  new KeyValuePair&lt;string, string&gt;("username", model.Username),
                  new KeyValuePair&lt;string, string&gt;("password", model.Password)
              };
                  var requestParamsFormUrlEncoded = new FormUrlEncodedContent(requestParams);
                  var tokenServiceResponse =  client.PostAsync(tokenServiceUrl, requestParamsFormUrlEncoded).Result;
                  var responseString =  tokenServiceResponse.Content.ReadAsStringAsync().Result;
                  var responseCode = tokenServiceResponse.StatusCode;
                  if (responseCode != HttpStatusCode.OK) return BadRequest();
                  var responseMsg = new HttpResponseMessage(responseCode)
                  {
                      Content = new StringContent(responseString, Encoding.UTF8, "application/json")
                  };
                  //ApplicationUser user =  UserManager.FindAsync("tester", "azerty123").Result;
  
                  ApplicationUser user = UserManager.FindByNameAsync(model.Username).Result;
  
  
                  if (user == null) return NotFound();
                  ClaimsIdentity oAuthIdentity = UserManager.CreateIdentityAsync(user, OAuthDefaults.AuthenticationType).Result;
                  IDictionary&lt;string, string&gt; data = new Dictionary&lt;string, string&gt;
                  {
                      //{ "userName", "tester" }
                      { "userName", model.Username }
                  };
                  AuthenticationProperties properties = new AuthenticationProperties(data);
  
                  AuthenticationManager.SignOut(properties);
                  AuthenticationManager.SignIn(properties);
  
                  Dictionary&lt;string, object&gt; account =  JsonConvert.DeserializeObject&lt;Dictionary&lt;string, object&gt;&gt;(responseString);
  
  
                  return Ok(account);
              }
          }
  </code></pre>
  
  <p><strong>Logout</strong></p>
  
  <pre><code> [Route("Logout")]
          [Authorize]
          public IHttpActionResult Logout()
          {
              AuthenticationManager.SignOut(CookieAuthenticationDefaults.AuthenticationType);
              return Ok();
          }
  </code></pre>
  
  <p>The problem is that when I log in the application, then I get the token to consume some secured services.When I log out, the token still available and I still can consume the secured services.</p>
  
  <p>So I need to know:</p>
  
  <ol>
  <li>What is the reason of this problem?</li>
  <li>How can I fix it?</li>
  </ol>