Blazor Server Allows System Use After Logout

We have a Blazor server app that uses AzureAD for authentication purposes: builder.Services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme) .AddMicrosoftIdentityWebApp(builder.Configuration.GetSection("AzureAd"));

We are happy that this works as expected.

The issue comes when logging out, which do with this:

NavManager.NavigateTo("MicrosoftIdentity/Account/SignOut", forceLoad: true, replace:true);

The user is then redirected by Blazor to the following page:

MicrosoftIdentity/Account/SignedOut

If we close the browser at this point, everything is fine and the user has to login again. The issue comes when the user does not close the browser and then navigates back to any page in the app, the navigation is successful and they do not have to login again.

I'm guessing that in some situations this is preferred, but for us, once logged out, they must re-enter their credentials to get back in. Does anyone know what I need to do to force this, there is lots of stuff around httpContext etc, but with Blazor server I do not have access to this.

Thanks

Chris

As sometimes happens I stumbled upon the answer soon after asking the question. Turns out the code was fine, the issue was to do with how we configure the user flow in Azure B2C.

Changing the user flow session behaviour from Application to policy signs the user out and requires them to logon again if they go back to the app without closing the browser.