After doing FormsAuthentication.SignOut(), user is not able to login again

Question

I am using formAuthentication with the following Web.Config file.

<authentication mode="Forms">
    <forms name="SnowBall" timeout="30" slidingExpiration="true" loginUrl="Login.aspx"      cookieless="AutoDetect">
    </forms>
</authentication>
<authorization>
    <deny users="?"/>
</authorization>

I have a user control which has a LogOut button. Code of the logout button is:

FormsAuthentication.SignOut();
Response.Redirect("Login.aspx");

After executing this code, I am no longer able to authenticate the user. When i click "Sign In", the page is refreshed and event handlers are not executed.

When I close the browser window and re-run the site, everything works fine. Please help me.

Answer 1

Hi,

First you need to clear that there are two separate Ids one is session id which is alloted for browser session and another is form authentication cookie which is encrypted alphanumeric id.

Whenever you use formauthentication.signout your formauthentication cookies will removed as per your implementation.But your session id will remain there.

You cancheck it by using fiddler/ firefox browser.

Answer 2

I have found the solution.Hope it helps somebody out there

Problem lies with this line

Response.Redirect("Login.aspx");

What it does is redirects user to Login.aspx with ReturnUrl as querystring.For Eg.

Login.aspx?ReturnUrl="Name of the page from where logout happened";

Now what happened was that FormsAuthentication.GetRedirectUrl() preserved this querystring path and after authentication was redirecting to this path.the user credentials i was putting in were not authorized to view this page.So i was always on the login screen.

To Resolve this issue replace

Response.Redirect("Login.aspx");

With

Response.Redirect(FormsAuthentication.LoginUrl);