I redirect the user to the login page when user click log out however I don't think it clears any application or session because all the data persisted when the user logs back in.
Currently the login page has a login control and the code behind on the page is only wired up the login Authenticate.
Can someone direct me to a good tutorial or article about handling log in and out of ASP.NET web sites?
Session.Abandon()
http://msdn.microsoft.com/en-us/library/ms524310.aspx
Here is a little more detail on the HttpSessionState object:
http://msdn.microsoft.com/en-us/library/system.web.sessionstate.httpsessionstate_members.aspx
I would prefer Session.Abandon()
Session.Clear() will not cause End to fire and further requests from the client will not raise the Session Start event.
The way of clearing the session is a little different for .NET core. There is no Abandon() function.
ASP.NET Core 1.0 or later
//Removes all entries from the current session, if any. The session cookie is not removed.
HttpContext.Session.Clear()
.NET Framework 4.5 or later
//Removes all keys and values from the session-state collection.
HttpContext.Current.Session.Clear();
//Cancels the current session.
HttpContext.Current.Session.Abandon();
for .Net core
[HttpPost]
public IActionResult Logout()
{
try
{
CookieOptions option = new CookieOptions();
if (Request.Cookies[AllSessionKeys.AuthenticationToken] != null)
{
option.Expires = DateTime.Now.AddDays(-1);
Response.Cookies.Append(AllSessionKeys.AuthenticationToken, "", option);
}
HttpContext.Session.Clear();
return RedirectToAction("Login", "Portal");
}
catch (Exception)
{
throw;
}
}