代码之家  ›  专栏  ›  技术社区  ›  dochoffiday

FormsAuthentication.SignOut()在更改CookieDomain后不起作用

  •  3
  • dochoffiday  · 技术社区  · 7 年前

    <authentication mode="Forms">
      <forms loginUrl="~/login" timeout="43200" slidingExpiration="true" name=".PX" />
    </authentication>
    

    此后,我们将其更新为:

    <authentication mode="Forms">
      <forms loginUrl="~/login" timeout="43200" slidingExpiration="true" name=".PX" enableCrossAppRedirects="true" domain="[websitename].com" />
    </authentication>
    

    问题是 已登录 FormsAuthentication.SignOut() .

    FormsAuthentication.SignOut() ,我现在执行以下操作,但它仍然没有注销当前登录的用户:

    private static void SignOut(HttpContextBase context)
    {
        RemoveCookie(context, FormsAuthentication.FormsCookieName, FormsAuthentication.FormsCookiePath, FormsAuthentication.CookieDomain, true);
        RemoveCookie(context, FormsAuthentication.FormsCookieName, FormsAuthentication.FormsCookiePath, FormsAuthentication.CookieDomain, false);
        RemoveCookie(context, FormsAuthentication.FormsCookieName, FormsAuthentication.FormsCookiePath, null, true);
        RemoveCookie(context, FormsAuthentication.FormsCookieName, FormsAuthentication.FormsCookiePath, null, false);
    
        // clear cookies server side
        context.Request.Cookies.Clear();
    
        context.Session.Abandon();
        FormsAuthentication.SignOut();
    }
    
    private static void RemoveCookie(HttpContextBase context, string name, string path, string domain, bool httpOnly)
    {
        context.Response.Cookies.Add(new HttpCookie(name, "NoCookie")
        {
            Path = path,
            Domain = domain,
            Secure = false,
            Shareable = false,
            HttpOnly = httpOnly,
            Expires = DateTime.Now.AddDays(-1d)
        });
    }
    
    1 回复  |  直到 7 年前
        1
  •  2
  •   dochoffiday    7 年前

    在 FormsAuthentication.SignOut() 删除 context.Response.Cookies.RemoveCookie(FormsCookieName); ( https://github.com/Microsoft/referencesource/blob/master/System.Web/Security/FormsAuthentication.cs#L421 )

    改变一切事物的顺序似乎可以解决问题:

    private static void SignOut(HttpContextBase context)
    {
        context.Session.Abandon();
        FormsAuthentication.SignOut();
    
        RemoveCookie(context, FormsAuthentication.FormsCookieName, FormsAuthentication.FormsCookiePath, FormsAuthentication.CookieDomain, true);
        RemoveCookie(context, FormsAuthentication.FormsCookieName, FormsAuthentication.FormsCookiePath, FormsAuthentication.CookieDomain, false);
        RemoveCookie(context, FormsAuthentication.FormsCookieName, FormsAuthentication.FormsCookiePath, null, true);
        RemoveCookie(context, FormsAuthentication.FormsCookieName, FormsAuthentication.FormsCookiePath, null, false);
    
        // clear cookies server side
        context.Request.Cookies.Clear();
    }