在ASP.NET Core MVC中如何捕获登录过期过程并触发方法？是否可行？

Absolutely, this is totally achievable with ASP.NET Core MVC's built-in authentication system! Let me break down the most practical approaches to capture when a user's login session expires and run your specified method.

1. Use CookieAuthenticationEvents (Recommended for Cookie-Based Auth) #

Since ASP.NET Core's default login system relies on cookie authentication, the CookieAuthenticationEvents class is your primary tool for hooking into authentication-related events—including expiration.

Option A: OnValidatePrincipal (Precise Expiration Check) #

This event fires every time the user's authentication ticket is validated (on every incoming request), making it ideal for detecting when the ticket has expired. Here's how to implement it:

// In Program.cs
using Microsoft.AspNetCore.Authentication.Cookies;

builder.Services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
    .AddCookie(options =>
    {
        // Set your desired session timeout
        options.ExpireTimeSpan = TimeSpan.FromMinutes(30);
        options.SlidingExpiration = true; // Auto-extend session on user activity

        options.Events = new CookieAuthenticationEvents
        {
            public async Task OnValidatePrincipal(CookieValidatePrincipalContext context)
            {
                // Check if the authentication ticket has expired
                if (context.Properties.ExpiresUtc.HasValue && 
                    context.Properties.ExpiresUtc.Value < DateTimeOffset.UtcNow)
                {
                    // Trigger your custom expiration method here
                    await YourCustomExpirationHandlerAsync(context.HttpContext);

                    // Mark the principal as invalid to force a login redirect
                    context.RejectPrincipal();
                    await context.HttpContext.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);
                }
            }
        };
    });

Option B: OnRedirectToLogin (Trigger on Login Redirect) #

If you want to run logic right before the user is redirected to the login page (e.g., after they try to access a protected resource with an expired session), use this event:

options.Events = new CookieAuthenticationEvents
{
    public async Task OnRedirectToLogin(RedirectContext<CookieAuthenticationOptions> context)
    {
        // Check if the redirect is due to an unauthorized (expired) session
        if (context.Response.StatusCode == StatusCodes.Status401Unauthorized)
        {
            // Run your custom method
            await YourCustomExpirationHandlerAsync(context.HttpContext);
        }

        // Keep the default redirect behavior
        context.Response.Redirect(context.RedirectUri);
    }
};

2. Combine with Session Expiration (If Using Session State) #

If your app uses ASP.NET Core Session, you can sync session expiration with authentication cookie expiration and add a middleware to detect timeouts:

Step 1: Configure Session #

// In Program.cs
builder.Services.AddSession(options =>
{
    options.IdleTimeout = TimeSpan.FromMinutes(30); // Match auth cookie timeout
    options.Cookie.HttpOnly = true;
});

Step 2: Create a Custom Middleware #

public class SessionExpirationMiddleware
{
    private readonly RequestDelegate _next;

    public SessionExpirationMiddleware(RequestDelegate next)
    {
        _next = next;
    }

    public async Task InvokeAsync(HttpContext context)
    {
        if (context.User.Identity.IsAuthenticated)
        {
            // Check if session is still active
            var lastActivity = context.Session.GetString("LastActivity");
            if (string.IsNullOrEmpty(lastActivity) || 
                DateTime.Parse(lastActivity) < DateTime.UtcNow.AddMinutes(-30))
            {
                // Trigger your custom logic
                await YourCustomExpirationHandlerAsync(context);
                
                // Sign out the user and clear session
                await context.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);
                context.Session.Clear();
            }
            else
            {
                // Update last activity timestamp
                context.Session.SetString("LastActivity", DateTime.UtcNow.ToString());
            }
        }

        await _next(context);
    }
}

// Register the middleware in Program.cs (order matters!)
app.UseSession();
app.UseMiddleware<SessionExpirationMiddleware>();
app.UseAuthentication();
app.UseAuthorization();

Key Notes #

• Async is Critical: Make sure your custom method (YourCustomExpirationHandlerAsync) is async to avoid blocking the request pipeline.
• Sliding Expiration: If enabled, the session extends automatically when the user is active—adjust your expiration checks to account for this.
• Distributed Scenarios: If your app runs on multiple servers, ensure your custom logic works across instances (e.g., use a shared cache or message queue if needed).

内容的提问来源于stack exchange，提问作者comfreakph