Session is not clearing after signing out from application razor pages

Blooming Developer 276

Hi,

I want to clear my sessions,once i logout from my application.

Now when i logout from application and click the back button,its navigating to the previous page.

My logout button is given as a menu in _Layout page like this

<li class="nav-item">
    <a class="nav-link" asp-page="/logout">
       <i class="fas fa-sign-out-alt nav-icon white"></i>
       <p>
          SIGN OUT
       </p>
     </a>
</li>

Logout.cshtml

<div class="row m-3">
    <div class="col-4"></div>
    <!--JUMBTRON STARTS HERE-->
    <div class="col-4">
        <div class="jumbotron text-center" style="margin-top:225px;">
            <div style="font-size:larger;font-family:Delivery;"><b>You have successfully logged out.</b></div>
            <div style="font-size:larger;font-family:Delivery;"><b>Please <a asp-page="/Login">click here</a> to login to the portal.</b></div>
        </div>
    </div>
    <!--JUMBTRON ENDS HERE-->
    <div class="col-4"></div>
</div>

Logout.cshtml.cs

public class LogoutModel : PageModel
    {
        public void OnGet()
        {
            HttpContext.Session.Clear();
        }

        public IActionResult OnPostSignOut()
        {
            
            string rootPath = Url.Content("~");
            return Redirect(rootPath + "/Login");
        }
    }

I am clearing the session when the logout page is loaded. Is there anything i am missing?

Zhi Lv - MSFT 32,016 Reputation points Microsoft Vendor

2023-01-31T07:52:36.64+00:00

Hi @Blooming Developer

How do you implement the login feature, use Asp.net core Identity or not? Have you configured cookie authentication for your application?

Generally, we will use cookies to store login user information. So, when logout we need to clear the cookie.

Blooming Developer 276

Hi @Zhi Lv - MSFT ,

I have a login method where user will key in username and password, upon successful authentication user will redirect to home page and i will set session variables at this time.

Please see my code below:

public async Task<IActionResult> OnPostAuthenticateUserAsync()
        {
            using (FlexWebApiServiceClient client = new FlexWebApiServiceClient(ConnectionType.Live))
            {
                SQLExecResult result = await client.Authenticate(UserName, Password);
                string hostName = Dns.GetHostName();
                
                if (result.Success)
                {
                    Console.WriteLine("Success");
                    string jsonString = result.JsonResult.ToString();
                    AuthenticateUserInfo AuthenticateUserInfo = JsonSerializer.Deserialize<AuthenticateUserInfo>(jsonString);
                    List<ADAttributes> ADAttributesList = AuthenticateUserInfo.ADAttributes;
                    string UserRole = "";
                    var CheckUserRole = await _context.UserManagement.FirstOrDefaultAsync(m => m.Username == ADAttributesList[0].AD);
                    //CheckUserRole.Userrole = null ? "User" : CheckUserRole.Userrole;
                    if (CheckUserRole != null)
                    {
                        UserRole = CheckUserRole.Userrole;
                        HttpContext.Session.SetString("UserRole", UserRole);
                    }
                    else
                    {
                        UserRole = "User";
                        HttpContext.Session.SetString("UserRole", UserRole);                        
                    }
                    HttpContext.Session.SetString("AD", ADAttributesList[0].AD.Trim());
                    HttpContext.Session.SetString("ADFull", ADAttributesList[0].ADFull.Trim());
                    HttpContext.Session.SetString("DisplayName", ADAttributesList[0].DisplayName.Trim());
                    HttpContext.Session.SetString("EmployeeNumber", ADAttributesList[0].EmployeeNumber.Trim());
                    HttpContext.Session.SetString("EmailAddress", ADAttributesList[0].EmailAddress.Trim());
                    HttpContext.Session.SetString("Department", ADAttributesList[0].Department.Trim());
                    HttpContext.Session.SetString("Title", ADAttributesList[0].Title.Trim());
                    HttpContext.Session.SetString("Manager", ADAttributesList[0].Manager.Trim());
                    HttpContext.Session.SetString("Mobile", ADAttributesList[0].Mobile.Trim());

                    Login.AD = ADAttributesList[0].AD.Trim();
                    Login.ADFull = ADAttributesList[0].ADFull.Trim();
                    Login.DisplayName = ADAttributesList[0].DisplayName.Trim();
                    Login.EmployeeNumber = ADAttributesList[0].EmployeeNumber.Trim();
                    Login.EmailAddress = ADAttributesList[0].EmailAddress.Trim();
                    Login.Department = ADAttributesList[0].Department.Trim();
                    Login.Title = ADAttributesList[0].Title.Trim();
                    Login.Manager = ADAttributesList[0].Manager.Trim();
                    Login.Mobile = ADAttributesList[0].Mobile.Trim();
                    Login.LoginTimeStamp = DateTime.Now;
                   // Login.IPAddress = Dns.GetHostByName(hostName).AddressList[0].ToString();

                    _context.Login.Add(Login);
                    await _context.SaveChangesAsync();

                    string rootPath = Url.Content("~");
                    Console.WriteLine(rootPath);
                    return Redirect(rootPath + "/Home");                    
                }
                else
                {
                    ErrorMessage = "Invalid Username/Password";
                    return Page();
                }               
            }
        }

Here is my Program.Cs file code

builder.Services.AddSession(options => {
    options.IdleTimeout = TimeSpan.FromMinutes(30);
    options.Cookie.HttpOnly = true;
    options.Cookie.IsEssential = true;
});

Do i need to remove the cookie also?

Zhi Lv - MSFT 32,016 Reputation points Microsoft Vendor

2023-02-02T06:43:12.13+00:00

Do i need to remove the cookie also?

You can try to remove the cookie, you can use F12 developer Application tools to check the cookies.

If still not working, can you share the relates code about where you validate the user is login or not?