1

I have an email confirmation controller that i post to.

When this happens, I need to log out, clear session and cookies regarding the user... this is because when they confirm their email, I need a button to disapear that allows the user to re-send confirmation email.

I do this like this:

[HttpPost]
[Authorize]
public async Task<ActionResult> ReSendEmailConfirmation(string userID)
{
    await this.SendEmailConfirmation( userID );

    //Log off to prevent stale user session
    AuthenticationManager.SignOut( DefaultAuthenticationTypes.ApplicationCookie );
    Session.Clear();
    Session.Abandon();
    Response.Cookies.Clear();

    return RedirectToAction( "ReSendEmailConfirmation" ); // I am logged out okay, but when i goto my email... click the confirmation link, then log back in... it still says my email is not confirmed. If i shut my browser down, it will then update.
}

The problem is that even after all of that...

When i log back in, it still says that the email is not confirmed... even though it is in the database...

How do i clear the user session out completely?

Jimmyt1988
  • 20,466
  • 41
  • 133
  • 233

1 Answers1

1

Session.Clear will clear all the sessions. And Response.Cookies.Clear will clear all cookies. and you can decorate your action with [NoCache] to prevent it from caching

Aram
  • 5,537
  • 2
  • 30
  • 41
  • I've tried the Cookies.Clear, still no luck.. I will try NoCache. What namespace is this in? – Jimmyt1988 Apr 08 '15 at 02:08
  • You can find associated problem here - [invalidate-old-session-cookie-asp-net-identity](https://stackoverflow.com/questions/34020730/invalidate-old-session-cookie-asp-net-identity) – krypru Feb 19 '18 at 11:07