The FormsAuthentication.SignOut method removes the forms-authentication ticket information from the cookie or the URL if FormsAuthentication.CookiesSupported is false. You can use the FormsAuthentication.SignOut method in conjunction with the FormsAuthentication.RedirectToLoginPage method to log one user out and allow a different user to log in.

If you run exclusively in cookieless mode, or if you support both authenticated and anonymous users, you should explicitly control the redirect to the login page if you require special business logic to execute as a result of removing the anonymous identifier.

When the FormsAuthentication.SignOut method is called, a redirect to the application's login page is made by calling the System.Web.HttpResponse.Redirect(string) method with the endResponse parameter set to false. The redirect does not take place until the current page has finished executing, so additional code can be run. If the code does not contain an explicit redirect to another page, the user is redirected to the login page configured in the application's configuration file.

Calling the FormsAuthentication.SignOut method only removes the forms authentication cookie. The Web server does not store valid and expired authentication tickets for later comparison. This makes your site vulnerable to a replay attack if a malicious user obtains a valid forms authentication cookie. To improve security when using a forms authentication cookie, you should do the following:

• Use absolute expiration for forms authentication cookies by setting the FormsAuthentication.SlidingExpiration property to false. This limits the window in which a hijacked cookie can be replayed.

• Only issue and accept authentication cookies over Secure Sockets Layer (SSL), by setting the FormsAuthentication.RequireSSL property to true and by running the entire Web site under SSL. Setting the FormsAuthentication.RequireSSL property to true ensures that ASP.NET will never send an authentication cookie to the browser over a non-SSL connection; however, the client might not honor the secure setting on the cookie. This means the client might send the forms authentication cookie over a non-SSL connection, thus leaving it vulnerable to hijack. You can prevent a client from sending the forms authentication cookie in the clear by running the entire Web site under SSL.

• Use persistent storage on the server to record when a user logs out of the Web site, and then use an application event such as System.Web.HttpApplication.PostAuthenticateRequest event to determine whether the current user was authenticated with forms authentication. If the user was authenticated with forms authentication, and if the information in persistent storage indicates the user is logged out, immediately clear the authentication cookie and redirect the browser back to the login page. After a successful login, update storage to reflect that the user is logged in. When you use this method, your application must track the logged-in status of the user, and must force idle users to log out.

Namespace: System.Web.Security
Assembly: System.Web (in System.Web.dll)
Assembly Versions: 1.0.5000.0, 2.0.0.0