How to Delete Authentication Cookie

Question

I am developing ASP.NET MVC application. I made some changes to save some extra info in cookie in latest version. Few of my customers are still running old version. Is there any way to expire the existing cookies of my existing customer and enforce them to log-on again when they connect to my new application hosted in IIS?

Thanks,

Answer 1

You could use the SignOut static method:

FormsAuthentication.SignOut();

This will remove the authentication cookie and on subsequent requests the user will not be authenticated. I stressed the word subsequent because after calling this method you should redirect.

Answer 2

I am giving newer name to my cookie in web.config, and this seem to solve my problem:-

 <forms loginUrl="~/Account/LogOn" name="InsightWebMobileCookie2" timeout="10000" slidingExpiration="true" />

Answer 3

The problem here is you cannot read the cookie expiration date so you don't know from the cookie who the old users are.

So your options are:

1. If you can figure out who is from the 'old' version - have logic to expire their cookie.
2. Force everyone to logout once if they dont have a cookie named "VersionLogout". Once you force their logout, set a cookie named "VersionLogout" with a value of 1.2 for example, this way you know you've forced their logout for a particular version and they (going forward) won't be prompted again.

You would put that code in a Application_AuthenticateRequest event in the global.asax. at this point a user has been authenticated so you can check their cookie there.