IIS 8.0 Website on F5 with SSL - unable to log out of website

Question

we have an odd situation where a user logs into the site (Asp.Net), and upon logging out, it only directs us to the main page " https://newsite/default.aspx " however if we replace default with login, we are immediately logged back in. This happens only when we go through the public IP with associated DNS A record located on the F5. If we open the site on the IIS server via IP binding " https://ipaddress/default ", I can login and logout and stay logged out, it works as expected. I have worked with F5 support and have tried multiple different configuration changes, and no dice, same behavior everytime. The newsite is set up identically in F5 to our current production site, and developers say the logout code is identical to current production so we are confused as to why this is happening. Persistence is set on the load balancer as well. Any help in the right direction would awesome.

Answer 1

A couple things I would suggest checking:

1. If you monitor the traffic with something like Fiddler and compare the results of login/logout with the F5 and without, do you see any difference? I would look for specific things like cookies being set or removed. I know ASP.NET uses specific cookies for sessions, so I would wonder if that cookie is not getting deleted properly on logout.

2. Once you log out of the site (when going through the F5), if you refresh the page, do you stay logged in (in this case, I could see where some kind of caching may send back the page even though you're logged out. If this is the case, you could have an F5 admin check to see if there's a Web Acceleration profile on the virtual server and remove it to see if that helps.

Answer 2

Looks like specific security cookie code was causing the issue of creating a duplicate cookie within ektron.

Following code was removed, and now log out is working properly via SSL through our F5.

Code removed: Dim lSec As SecurityAPI.Cookie = New SecurityAPI.Cookie(Me, mServerEnvironment, mCOGUser.PeopleID) lSec.SetCookie()