ASP.Net Session Not Invalidated After Logout

Question

I have a ASP.Net application in my login page I call

FormsAuthentication.SignOut 
Session.Abandon() 
Session.Clear()

however the Appscan is taking the ASPXAUTH cookie value then after logout is able to re-inject the cookie value to gain access to protected pages.

Microsoft has acknowledged a problem but only offers advice not a fix - http://support.microsoft.com/kb/900111

Can someone provide examples how to fix this issue

Answer 1

One option is to have a UserSession table and insert a record into this table when the user logs in. When you logout either delete the entry or mark it invalid. On the secure pages, verify that a UserSession exists for the logged in user and redirect to a login page if it does not.