This has been asked before, but I haven't seen anything posted about it in years, and I'm running into the problem now.
Steps to reproduce:
- Log into my site (C# 6, angularjs, .Net Framework 4.8)
- Once logged in, use Cookie Editor to export the session cookies in the browser (using Chrome in this instance, but that doesn't matter.)
- Log out
- Using Cookie editor, import the copied session cookies.
- Refresh the page... voila - I'm logged back in.
So, my code for logging out does all the "get rid of stored cookies" things it should: loop through all the cookies and expire them; clear the Request.Cookies; Abandon the Session; Clear the Session; RemoveAll on the session.
But when you paste that dang .ASPXAUTH cookie back into the browser... whammo. Logged in.
I'm not sure how to prevent this, and could really use the help.