Unable to logout from ASP.NET MVC application using FormsAuthentication.SignOut()

Question

I am trying to implement Logout Functionality in ASP.NET MVC.

I use Forms Authentication for my project.

This is my Logout code:

FormsAuthentication.SignOut();
Response.Cookies.Clear();
FormsAuthenticationTicket ticket = 
    new FormsAuthenticationTicket(
        1,
        FormsAuthentication.FormsCookieName,
        DateTime.Today.AddYears(-1),
        DateTime.Today.AddYears(-2),
        true,
        string.Empty);

Response.Cookies[FormsAuthentication.FormsCookieName].Value = 
            FormsAuthentication.Encrypt(ticket); 
Response.Cookies[FormsAuthentication.FormsCookieName].Expires = 
            DateTime.Today.AddYears(-2);

return Redirect("LogOn");

This code redirects the user to the Login Screen. However, if I call an action method by specifying the name in address bar (or select the previous link from address bar dropdown), I am still able to reach the secure pages without logging in.

Could someone help me solve the issue?

Answer 1

That's strange... I make one single call to: FormsAuthentication.SignOut(); and it works...

public ActionResult Logout() {
  FormsAuthentication.SignOut();
  return Redirect("~/");
}

Answer 2

To correctly answer your question, I'd have to know how do you secure your "secure" pages.
I suspect that you're doing something wrong there.

A simple call to FormsAuthentication.SignOut() should be enough, as it clears the authentication cookie, thus making the other method calls you make there redundant.

With ASP.NET MVC, you have to use the AuthorizeAttribute on an action method to disallow non-authenticated visitors to use it. (Meaning: the old way you did it with Web Forms by specifying location tags in Web.config no longer works with MVC.)

For example, here is a small code snippet from my ForumController class:

public class ForumController : Controller
{
    ...

    [Authorize]
    public ActionResult CreateReply(int topicId)
    {
        ...
    }

    ...
}

Answer 3

Check if you use on the requireSSL="true".

If you do then you need to be on secure page (ssl) for do anything with the login/logout. Do you ?

If you are not on ssl connection then its not going to read/write the cookie.