Can't validate security stamp in asp.net core - concurrency

Question

Im using asp.net core Identity. What I'm trying to do is when a user login again using the same credentials the previous login should be logged out. This is my code:
Login Controller Code
[HttpPost]
public async Task<IActionResult> Login(LoginDto loginDto){
if(!modelState.IsValid)
return View(logindto);
var user = await _userManager.FindByNameAsync(loginDto.username);
if (user.Session==false){
user.Session=true;
await _userManager.UpdateSecurityStampAsync(user);
user.LoginDate = DateTime.Now;
_context.SaveChanges();
}
Identity service extension
public static class IdentityServiceExtensions
{
public static IServiceCollection AddIdentityServices(this IServiceCollection services, IConfiguration config)
{
services.AddIdentityCore<AppUser>().AddRoles<Role>()
.AddEntityFrameworkStores<DataContext>().AddSignInManager<CustomSignInManager<AppUser>>();
services.Configure<SecurityStampValidatorOptions>(options=>{
options.ValidationInterval=TimeSpan.Zero;
});
//implement cookie
services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme).AddCookie(opt =>
{
opt.Cookie.Name = "cClient";
opt.Cookie.HttpOnly = true;
opt.LoginPath = "/Auth/Login/";
opt.LogoutPath = "/Auth/Logout/";
opt.ExpireTimeSpan = System.TimeSpan.FromMinutes(10);
opt.AccessDeniedPath = "/Error/Handle/401";
});
services.Configure<CookiePolicyOptions>(opt =>
{
opt.MinimumSameSitePolicy = SameSiteMode.Strict;
opt.ConsentCookie.HttpOnly = true;
});
services.AddMvc(opt =>
{
var policy = new AuthorizationPolicyBuilder()
.RequireAuthenticatedUser()
.Build();
opt.Filters.Add(new AuthorizeFilter(policy));
});
services.AddAuthorization(opt =>
{
opt.AddPolicy("HoOnly", policy => policy.Requirements.Add(new HoOnly()));
});
return services;
}
}
}
Start up
public class Startup
{
private readonly IConfiguration _configuration;
public Startup(IConfiguration configuration)
{
_configuration = configuration;
}
// This method gets called by the runtime. Use this method to add services to the container.
public void ConfigureServices(IServiceCollection services)
{
services.AddApplicationServices(_configuration);
services.AddIdentityServices(_configuration);
services.AddAntiforgery(options =>
{
options.Cookie.SecurePolicy = Microsoft.AspNetCore.Http.CookieSecurePolicy.Always;
options.Cookie.HttpOnly = true;
options.Cookie.IsEssential = true;
});
}
// This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
//security middleware
app.UseXContentTypeOptions();
app.UseReferrerPolicy(opt => opt.NoReferrer());
app.UseXXssProtection(opt => opt.EnabledWithBlockMode());
app.UseXfo(opt => opt.Deny());
app.UseCsp(opt => opt
.BlockAllMixedContent()
.StyleSources(s => s.Self().UnsafeInline())
.FontSources(s => s.Self())
.FormActions(s => s.Self())
.FrameAncestors(s => s.Self())
// .ImageSources(s => s.Self().CustomSources("https://www.w3.org/2000/svg"))
// .ScriptSources(s => s.UnsafeInline().Self().UnsafeEval().CustomSources("sha256-NkjQhhVxID3uKTZQylIN4GOkRMSDKaVyPr5YZsv+cTU="))
);
if (env.IsDevelopment())
{
app.UseDeveloperExceptionPage();
}
else
{
app.UseExceptionHandler("/Home/Error");
// The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
app.Use(async (context, next) =>
{
context.Response.Headers.Add("Strict-Transport-Security", "max-age=31536000");
await next.Invoke();
});
app.UseHsts();
}
app.UseStatusCodePagesWithReExecute("/Error/Handle/{0}");
app.UseHttpsRedirection();
app.UseAntiXssMiddleware();
//cookie
app.UseCookiePolicy();
app.UseStaticFiles();
app.UseRouting();
app.UseCors("CorsPolicy");
//auth
app.UseAuthentication();
app.UseAuthorization();
app.UseEndpoints(endpoints =>
{
endpoints.MapControllerRoute(
name: "default",
pattern: "{controller=Home}/{action=Index}/{id?}");
});
}
}
}
But it does not sign out/logout the user. What am I doing wrong?
Start up
Identity service extension
Login Controller