How to Kill Session with help of javascript?

Question

Is it possible to destroy session using java script? If yes how it can be done? I am using Asp.Net with C#.

Help Appreciated!

Thanks in advance

Answer 1

If the cookie (that contains the session ID used to link the user to the session) is not HttpOnly , it can be unset in JavaScript.

function deletecookie(name) {
        var expdate = new Date();
        expdate.setTime(expdate.getTime() - 1);
        document.cookie = name += "=; expires=" + expdate.toGMTString();
}

If it is HttpOnly (and generally, most authentication-related cookies should be!) then you cannot influence it from JavaScript. A good description of JavaScript/cookies is here .

Bear in mind that this is not destroying the session, it is merely breaking the user's link with it an effectively logging them out. If they have a record of the ID stored in the cookie, or third party has intercepted it, the session can be "resumed" (or reused) by including that cookie on the next request to your application.

A safer route would be to AJAX back the logout/session-destroy request to your application, and actually destroy the session server-side.

Answer 2

Since JavaScript have no control over asp.net session, so you have to call server side code that manages with sessions.

you may call some page partially via ajax like

$.get('~/ClearForm.aspx');

Or you can also redirect to particular page that has session destroying code. for example on logout we redirects to logout page which destroys session.