2

In my web application I use totally custom functionality for logging in.So, nothing from Web.Security.
I control everything with Session and ViewState variables. To log out from the application I use Session.Abandon() command.

I wonder if I should also call FormsAuthentication.SignOut()?I took a look at the official documentation of this method, but did not quite get it.What benefit do I take from it?

Mathew Thompson
  • 55,877
  • 15
  • 127
  • 148
Mikayil Abdullayev
  • 12,117
  • 26
  • 122
  • 206

4 Answers4

3

If you're still using forms authentication (even though you're not using the built-in ASP.NET Membership provider), then yes you should call SignOut as it'll get rid of the authentication cookie.

However, if you've even gone as far as to not use forms authentication at all, then there'll be no authentication cookie, so there's no point in calling it.

Mathew Thompson
  • 55,877
  • 15
  • 127
  • 148
3

I have to admit that the official documentation has a lot to say on SignOut. The remarks section contains a lot of interesting information.

The SignOut method removes the forms-authentication ticket information from the cookie or the URL if CookiesSupported is false. You can use the SignOut method in conjunction with the RedirectToLoginPage method to log one user out and allow a different user to log in. If you run exclusively in cookieless mode, or if you support both authenticated and anonymous users, you should explicitly control the redirect to the login page if you require special business logic to execute as a result of removing the anonymous identifier. When the SignOut method is called, a redirect to the application's login page is made by calling the Redirect method with the endResponse parameter set to false. The redirect does not take place until the current page has finished executing, so additional code can be run. If the code does not contain an explicit redirect to another page, the user is redirected to the login page configured in the application's configuration file.

Calling the SignOut method only removes the forms authentication cookie. The Web server does not store valid and expired authentication tickets for later comparison. This makes your site vulnerable to a replay attack if a malicious user obtains a valid forms authentication cookie. To improve security when using a forms authentication cookie, you should do the following:

  • Use absolute expiration for forms authentication cookies by setting the SlidingExpiration property to false. This limits the window in which a hijacked cookie can be replayed.
  • Only issue and accept authentication cookies over Secure Sockets Layer (SSL), by setting the RequireSSL property to true and by running the entire Web site under SSL. Setting the RequireSSL property to true ensures that ASP.NET will never send an authentication cookie to the browser over a non-SSL connection; however, the client might not honor the secure setting on the cookie. This means the client might send the forms authentication cookie over a non-SSL connection, thus leaving it vulnerable to hijack. You can prevent a client from sending the forms authentication cookie in the clear by running the entire Web site under SSL.
  • Use persistent storage on the server to record when a user logs out of the Web site, and then use an application event such as PostAuthenticateRequest event to determine whether the current user was authenticated with forms authentication. If the user was authenticated with forms authentication, and if the information in persistent storage indicates the user is logged out, immediately clear the authentication cookie and redirect the browser back to the login page. After a successful login, update storage to reflect that the user is logged in. When you use this method, your application must track the logged-in status of the user, and must force idle users to log out.

You can see it here

So, to sum it all up, yes you should call SignOut

Huske
  • 9,186
  • 2
  • 36
  • 53
2

You don't need to use

FormsAuthentication.SignOut();

If you are not using form-authentication.
Here is a good link
FormsAuthentication.SignOut() does not log the user out

Community
  • 1
  • 1
शेखर
  • 17,412
  • 13
  • 61
  • 117
  • Although I agree with this link that you posted, I don't agree with the method used because it is a matter of time before this is fixed, and the practice of SignOut should still be used. – Huske Mar 19 '13 at 11:24
  • @Shekar, I don't understand either why would someone downvote your answer when it clearly addresses my question. – Mikayil Abdullayev Mar 19 '13 at 11:24
-1

You can use Membership provider in order to reduce development time for management security need (Identity).

You have also tool regsql in order to install youur database for your users, you have also RoleManager functionality for manage Roles of users (Principal)

Some links :

http://msdn.microsoft.com/fr-fr/library/ms229862(v=vs.80).aspx

Aghilas Yakoub
  • 28,516
  • 5
  • 46
  • 51