WebSecurity.Logout（）和Session.Abandon（）組合無法終止會話

Question

我一直在嘗試弄清為什么WebSecurity.Logout（）和Session.Abandon（）並無法終止我的會話。 我在網絡服務器上托管了一個無法注銷用戶的應用程序。 在調試中，它可以成功注銷並按預期返回登錄頁面。 我剛剛在Cookie中添加了.Domain屬性，以便登錄后即可訪問子域的其余部分。 我的cookie創建如下：

var authTicket = new FormsAuthenticationTicket(model.UserName, false, (int)FormsAuthentication.Timeout.TotalMinutes);
var authCookie = new HttpCookie(FormsAuthentication.FormsCookieName, FormsAuthentication.Encrypt(authTicket));
//authCookie.Domain = "mysite.org"
authCookie.Domain = "127.0.0.1";
Response.AppendCookie(authCookie);

我在堆棧溢出中發現了另一條建議覆蓋會話的帖子，即使執行此操作也是如此：

WebSecurity.Logout();
Session.Abandon();

//clear authentication cookie
HttpCookie cookie1 = new HttpCookie(FormsAuthentication.FormsCookieName, "");
cookie1.Expires = DateTime.Now.AddYears(-1);
Response.Cookies.Add(cookie1);

//clear session cookie (not necessary for your current problem but i would recommend you do it anyway)
HttpCookie cookie2 = new HttpCookie("ASP.NET_SessionId", "");
cookie2.Expires = DateTime.Now.AddYears(-1);
Response.Cookies.Add(cookie2);

有什么想法會阻止它在調試中不會發生的Web服務器上工作？ 是否有其他形式的Web服務器Cookie可以保留此會話？

Answer 1

您還需要在清除cookie時在其cookie上設置域，否則，它將只是在完整域級別（ www.mysite.org ）上設置一個新cookie，而不是清除mysite.org cookie。

//clear authentication cookie
HttpCookie cookie1 = new HttpCookie(FormsAuthentication.FormsCookieName, "");
cookie1.Expires = DateTime.Now.AddYears(-1);
cookie1.Domain = "mysite.org";
Response.Cookies.Add(cookie1);

//clear session cookie (not necessary for your current problem but i would recommend you do it anyway)
HttpCookie cookie2 = new HttpCookie("ASP.NET_SessionId", "");
cookie2.Expires = DateTime.Now.AddYears(-1);
cookie2.Domain = "mysite.org";
Response.Cookies.Add(cookie2);