FormsAuthentication.SignOut() does not work

Question

I'm developing a website with a secure part, that is the folder named 'PIP'.

The login part works okay, but when i click logoff the user is still known and won't be redirected to the login page if he/she touches the secure part.

Here is my web.config:

<system.web>

<authentication mode="Forms">
  <forms loginUrl="Login.aspx" name=".ASPXFORMSAUTH">
  </forms>
</authentication>

</system.web>

<location path="PIP">
<system.web>
  <authorization>
    <deny users="?" />
  </authorization>
</system.web>
</location>

My login page where the user is authenticated:

FormsAuthentication.RedirectFromLoginPage(uid, false);

On the default.aspx page in the secured folder (PIP) has a logoff button, the code behind that button:

FormsAuthentication.SignOut();
Response.Redirect("~/Default.aspx", true);

On the page "Default.aspx" is a link that goes to ~/PIP/Default.aspx, it should be redirected to the login page but is does not. It seems the session is not affected by the signout.

I've tried a lot of options, manually deleting the sessions. Session.Clear, Session.Abandon but nothing seems to be working.

I hope you guys can point me in right direction!

Thanks in advance.

Answer 1

You need to abandon the session after signing out.

FormsAuthentication.SignOut();
Session.Abandon();
Response.Redirect("~/Default.aspx", true);