Unable to logout from ASP.NET MVC application using FormsAuthentication.SignOut()

Question

I am trying to implement Logout Functionality in ASP.NET MVC.

I use Forms Authentication for my project.

This is my Logout code:

FormsAuthentication.SignOut();
Response.Cookies.Clear();
FormsAuthenticationTicket ticket = 
    new FormsAuthenticationTicket(
        1,
        FormsAuthentication.FormsCookieName,
        DateTime.Today.AddYears(-1),
        DateTime.Today.AddYears(-2),
        true,
        string.Empty);

Response.Cookies[FormsAuthentication.FormsCookieName].Value = 
            FormsAuthentication.Encrypt(ticket); 
Response.Cookies[FormsAuthentication.FormsCookieName].Expires = 
            DateTime.Today.AddYears(-2);

return Redirect("LogOn");

This code redirects the user to the Login Screen. However, if I call an action method by specifying the name in address bar (or select the previous link from address bar dropdown), I am still able to reach the secure pages without logging in.

Could someone help me solve the issue?

@Aliostad : Now changed the source code , previously the method call was wrapped. — vijaysylvester
– vijaysylvester, Commented Oct 8, 2010 at 10:04
@vijaysylvester - Could you please give us some details about how you actually make your secure pages secure? — Venemo
– Venemo, Commented Oct 8, 2010 at 10:20
I have configured them in Web.Config to deny access for users not authenticated. — vijaysylvester
– vijaysylvester, Commented Oct 8, 2010 at 10:28
@vijaysylver - there's your problem. This is not web forms, this is MVC. Venemo's answer is spot on - you need to decorate the action methods with authorize. I bet even if you didnt log in, you could get to any secure page. — RPM1984
– RPM1984, Commented Oct 8, 2010 at 10:30

Palantir · Accepted Answer · 2010-10-08 09:53:22Z

6

That's strange... I make one single call to: FormsAuthentication.SignOut(); and it works...

public ActionResult Logout() {
  FormsAuthentication.SignOut();
  return Redirect("~/");
}

answered Oct 8, 2010 at 9:53

Palantir

24.2k11 gold badges79 silver badges88 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

vijaysylvester Over a year ago

I used reflector and saw what the FormsAuth.SignOut() was doing. It does the same thing i am trying to accomplish. that is setting the cookie's expires property to the previous date. But it carefully adds the cookie to the response , but i dint do that , that is the issue here. Thanks for the help!

Venemo · Accepted Answer · 2010-10-08 10:38:22Z

1

To correctly answer your question, I'd have to know how do you secure your "secure" pages.
I suspect that you're doing something wrong there.

A simple call to FormsAuthentication.SignOut() should be enough, as it clears the authentication cookie, thus making the other method calls you make there redundant.

With ASP.NET MVC, you have to use the AuthorizeAttribute on an action method to disallow non-authenticated visitors to use it. (Meaning: the old way you did it with Web Forms by specifying location tags in Web.config no longer works with MVC.)

For example, here is a small code snippet from my ForumController class:

public class ForumController : Controller
{
    ...

    [Authorize]
    public ActionResult CreateReply(int topicId)
    {
        ...
    }

    ...
}

edited Oct 8, 2010 at 10:38

answered Oct 8, 2010 at 9:53

Venemo

19.2k13 gold badges90 silver badges131 bronze badges

8 Comments

vijaysylvester Over a year ago

To be clear , Even if you clear the cookie at server side using SignOut(), The Client passes the Forms Auth Cookie at the next request. To prevent this i am adding a cookie with same name , but with an expired time.

Venemo Over a year ago

@vijaysylvester - Well then, how do you explain that it works for me and @Palantir too?

RPM1984 Over a year ago

@vijaysylvester - you are correct that the cookie will still be sent (until it is expired), but it wont matter, as this cookie will be seen as 'stale' to ASP.NET. There are other steps to bolster this, such as absolute expiration and SSL - but the 'hack' of adding a cookie with the same name is not one of them. I dont think FormsAuth is the problem here.

vijaysylvester Over a year ago

@Venemo: Cheers mate! You both were successful in the 1st line that is FormsAuthentication.SignOut() , Since i was not , i tried other options as well. As simple as that.

RPM1984 Over a year ago

Im confused, are you saying you didnt have FormsAuthentication.SignOut() in your original code? Then why is it in the question?

|

Community · Accepted Answer · 2017-05-23 12:16:49Z

1

The following question is related the it's solution works for me

FormsAuthentication.SignOut() does not log the user out

edited May 23, 2017 at 12:16

CommunityBot

11 silver badge

answered Jun 17, 2011 at 16:33

Phil Hale

3,5012 gold badges38 silver badges50 bronze badges

Comments

Jahed Kabiri · Accepted Answer · 2018-04-27 09:10:33Z

This method works, if you do not disable[comment] the following tags in the web.config file to test your web application easily.

public ActionResult SignOut()
{
    FormsAuthentication.SignOut();
    return RedirectToAction("Index", "Home");
}

web.config

<authentication mode="Forms">
  <forms name="Your Project Name" defaultUrl="/" loginUrl="/Users/Login" timeout="43200" />
</authentication>

<location path="Administrator">
  <system.web>
    <authorization>
      <allow roles="Administrator" />
      <deny users="*" />
    </authorization>
  </system.web>
</location>

<location path="UserPanel">
  <system.web>
    <authorization>
      <deny users="?" />
    </authorization>
  </system.web>
</location>

Collectives™ on Stack Overflow

Unable to logout from ASP.NET MVC application using FormsAuthentication.SignOut()

4 Answers 4

1 Comment

8 Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

1 Comment

8 Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related