services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme).AddCookie();

app.UseAuthentication();

 /// <summary>
 ///
 /// </summary>
 /// <param name="model"></param>
 /// <param name="returnUrl"></param>
 /// <returns></returns>
 [HttpPost]
 [AllowAttribute]
 [ValidateAntiForgeryToken]
 public async Task<IActionResult> Login(LoginModel model, string returnUrl = null)
 {
  if (!ModelState.IsValid)
  {
  return Json(new { state = "error", message = "數(shù)據(jù)驗(yàn)證失敗" });
  }
  string ip = GetRemoteIpAddress();
  var r = await UserApp.SaasLoginAsync(model.Account, model.Password, ip);
  if (!string.IsNullOrEmpty(r.Error))
  {
  return Json(new { state = "error", message = r.Error });
  }
  var claims = new List<Claim>
     {
      new Claim(ClaimTypes.UserData, getCurrentUser(r.User, ip).ToString()),
     };
  var claimsIdentity = new ClaimsIdentity(
  claims, CookieAuthenticationDefaults.AuthenticationScheme);
  var authProperties = new AuthenticationProperties
  {
  ExpiresUtc = DateTimeOffset.Now.AddMinutes(120)
  };
  await HttpContext.SignInAsync(
  CookieAuthenticationDefaults.AuthenticationScheme,
  new ClaimsPrincipal(claimsIdentity),
  authProperties);
  return Json(new { state = "success", message = "登錄成功。", returnUrl = RedirectToLocal(returnUrl) });
 }

 /// <summary>
 ///
 /// </summary>
 /// <returns></returns>
 [HttpPost]
 [ValidateAntiForgeryToken]
 public async Task<IActionResult> LogOff()
 {
  if (bool.Parse(Configuration.GetSection("IsIdentity").Value))
  {
  return SignOut("Cookies", "oidc");
  }
  else
  {
  if (User.Identity.IsAuthenticated)
  {
   string userdata = User.Claims.FirstOrDefault(o => o.Type == ClaimTypes.UserData)?.Value;
   await UserApp.LogOffAsync(CurrentUser.FromJson(userdata));
  }
  await HttpContext.SignOutAsync(
   CookieAuthenticationDefaults.AuthenticationScheme);
  return RedirectToAction(actionName: nameof(Login), controllerName: "Account");
  }
 }