I have this html in my asp.net MVC 4 application:
@if (User.Identity.IsAuthenticated)
<li class="login-link"> {
@Html.ActionLink(User.Identity.Name, "LogOff", "Account")
</li>
}
and this controller action
//[HttpPost]
//[ValidateAntiForgeryToken]
public ActionResult LogOff()
{
WebSecurity.Logout();
return RedirectToAction("Index", "Home");
}
but when i click log out link, user doesnt log out.
Please suggest how to fix it
In your code sample above, you wrote:
@if (User.Identity.IsAuthenticated)
<li class="login-link"> {
@Html.ActionLink(User.Identity.Name, "LogOff", "Account")
</li>
}
Based on how your @if (User.Identity.IsAuthenticated) statement resolves this may lead to some wonky code being rendered for the browser.
Does the following Razor code more correctly reflect your intent?
@if (User.Identity.IsAuthenticated)
{
<li class="login-link">
@Html.ActionLink(User.Identity.Name, "LogOff", "Account")
</li>
}
I couldn't find anything wrong with your code. But try this and let me know if it works for you:
cshtml :
@Html.ActionLink("Log Off", "LogOff", "LogOn", null, new { @class = "actnclass" })
controller :
public ActionResult LogOff()
{
Request.Cookies.Remove("UserId");
FormsAuthentication.SignOut();
return RedirectToAction("LogOn", "LogOn");
}
Your Razor code looks good. Even a basic html logout code like the one below should do
<a href="@Href("~/Account/LogOff")">Logout</a>
Keep a breakpoint in your LogOff action in your Account controller and see what is happening. You seem to be using WebSecurity.Logout(); to logout and then redirect the user to the Home/Index page.
Also would like to know by looking at what are you inferring that user has not logged out.
Nothing wrong with you code. The point is the Action LogOff in Account is HttpPost Method, so it will only accept from a form submit.
You have to 3 ways to achieve Log off functionality
Add an HttpGet overload for it take one parameter to leave the HttpPost method in Account Controller
[HttpGet]
public ActionResult LogOff(string token) {
AuthenticationManager.SignOut(DefaultAuthenticationTypes.ApplicationCookie);
return RedirectToAction("Index", "Home");
}
// Already Exists
[HttpPost]
[ValidateAntiForgeryToken]
public ActionResult LogOff() {
AuthenticationManager.SignOut(DefaultAuthenticationTypes.ApplicationCookie);
return RedirectToAction("Index", "Home");
}
Use Javascript to submit the LogOff form
@using Microsoft.AspNet.Identity
@if (Request.IsAuthenticated)
{
using (Html.BeginForm("LogOff", "Account", FormMethod.Post, new { id = "logoutForm" }))
{
@Html.AntiForgeryToken()
// ...
<a href="javascript:document.getElementById('logoutForm').submit()">LogOff</a>
}
}
