Clearing a session in ASP.NET

Question

I'm a new developer, and I've been assigned the task of figuring out why our log out function is not working. I've tried every possible method I can find. Below is the log I've kept that includes the methods I've used.

1. Added a log out button to the CommonHeader.ascx form

2. Have tried numerous methods in the logout.aspx.vb form to get it to end or clear the session but none of them work.

a. ClearSession sub routine defined in the logout.aspx.vb form:

Session("Variable") = ""
FormsAuthentication.SignOut()
Session.RemoveAll()
Session.Abandon()
Session.Clear()

b. Also added this to the top of the Page_Load sub routine:

HttpContext.Current.Response.Cache.SetCacheability(HttpCacheability.NoCache)
HttpContext.Current.Response.Cache.SetNoServerCaching()
HttpContext.Current.Response.Cache.SetNoStore()

c. Also changed the ClearSession sub routine to Session.Contents.Remove("Variable") from Session("Variable") = ""

None of these methods work. We use Siteminder, and I've been wondering if this is the root of the problem. I just can't find anything on clearing a Session that uses Siteminder. Also keep in mind this application is coded with Visual Studio 2003.

This is the code for the button I'm using in the ascx file:

athp:TopNavText Title="Log Out" NavigateUrl="logout.aspx" Target="_top"/

Then on the "logout.aspx" form I've tried just using one of the methods described above or a combination of each one. This is the code before I ever touch it:

Private Sub Page_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load  

     ClearSession() 
     Response.Redirect("login.aspx") 

End Sub 

Public Sub ClearSession() 

     Session("Variable") = "" 

End Sub

Answer 1

Finally figured out the solution, I originally did not define the domain upon deletion of the cookie which contained the siteminder session id. The code I used is as following:

        Dim cookie3 As HttpCookie = New HttpCookie("SMSESSION", "NO")
        cookie3.Expires = DateTime.Now.AddYears(-1)
        cookie3.Domain = ".domain.com"
        Response.Cookies.Add(cookie3)

        Response.Redirect("login.aspx")

Answer 2

This question: formsauthentication-signout-does-not-log-the-user-out describes a problem with not clearing cookies even after calling FormsAuthentication.SignOut(). This sounds like your issue, they say it's a bug with .NET and as your using 1.1 this sounds distinctly possible.

Answer 3

HI friend please add the click event of the button in user control. And in the click event please add the following code and remove all the other code.

Session("Variable") = "";

Answer 4

look at this post

C# Clear Session

Whether its c sharp or vb the same rules still apply. You are calling session abandon then clear, but by the time you call clear the session should be gone anyway.

Clear keeps the session state along with the objects in it, so by calling it after abandon you could in fact be reinitializing a session for the user, but with cleared variables.

See this post for the order and proper way to kill the session and redirect to the login page if you have one

FormsAuthentication.SignOut() does not log the user out

Answer 5

The first thing to note is that, if you're using Forms Authentication, Session has absolutely nothing to do with whether or not a user is logged in.

Calling FormsAuthentication.SignOut will remove the forms-authentication ticket information from the cookie or the URL if CookiesSupported is false.

But it will have no effect on what is stored in Session.

UPDATE

Why do you think log out (FormsAuthentication.SignOut) is not working? What are you expecting to happen when you click on Sign Out, and what exactly is actually happening?

I'd get rid of all the code to clear Session and look at this. For example, look at the http traffic with a tool such as Fiddler: you should be able to see that the FormsAUthentication cookie is removed when you click on Log Out.