How to expire Authentication Cookie in ASP.NET MVC5.

Question

I'm trying these following code.

I use AuthenticationManager.SignOut(DefaultAuthenticationTypes.ApplicationCookie) to SignOut the web page.

But It's seem to doesn't work correctly, It could access again in same http request including with using same Authentication Cookie.

how do I change the code for fix this matter.

        // POST: /Account/LogOff
        [HttpPost]
        [ValidateAntiForgeryToken]
        public ActionResult LogOff()
        {
            AuthenticationManager.SignOut(DefaultAuthenticationTypes.ApplicationCookie);
 
            Session.RemoveAll();
            Session.Abandon();
            Session.Clear();

            Response.Cookies.Clear();

            return RedirectToAction("Index", "Home");
        }

Answer 1

Add this after your line:

AuthenticationManager.SignOut(DefaultAuthenticationTypes.ApplicationCookie);

    // Expire the cookie by setting its expiration date to a past date
    var cookie = new HttpCookie("YourAuthCookieName")
    {
        Expires = DateTime.UtcNow.AddDays(-1)
    };
    
    // Add the expired cookie to the response to update the client's cookie
    Response.Cookies.Add(cookie);

Make sure to replace "YourAuthCookieName" with the actual name of your authentication cookie.

Answer 2

Your scenario is not clear. The delete cookie, just sends the cookie back to the browser as expired. The cookie is not invalided, the browser just will not send it anymore. If you are using a tool, it may not honor the delete.

also if you are using single sign on, often the login server has its own cookie, so it can login the user without asking for credentials. If home/index requires authentication, than this could be happening.