Why isn't my cookie being removed?

Question

I'm trying to create a persistent cookie (not using the built-in auth) when the user logs in.

The only way I could figure to do this was to create a cookie with an expiry date set to DateTime.Now.AddYears(1)

Since I want to allow the user to log out, I do have a logout button on the layout for every page behind the login form.

This logout button looks like this:

<li>@Html.ActionLink("Log Out", "Logout", "Home")</li>

The confusing thing to me is that this code doesn't get rid of the cookie from the browser. it takes me back to the login form, but I can still easily navigate back to the protected pages and it'll still remember who I am based on my previous login.

Here's my code:

    [AllowAnonymous]
    public ActionResult Index()
    {
        return View();
    }

    [HttpPost]
    public ActionResult Login(User model)
    {
        try
        {
            DoLogin(model.EmailAddress, model.Password);
            return Json(new
            {
                Message = "Success",
                IsOK = bool.TrueString
            });
        }
        catch (Exception ex)
        {
            SendError("/", ex);
            return ReportError(ex, "USER LOGIN");
        }
    }

    private void DoLogin(string EmailAddress, string Password)
    {
        var user = db.Users.Include("UserRole").FirstOrDefault(x => x.EmailAddress == EmailAddress);

        if (Hashing.ValidatePassword(Password, user.Password))
            generateCookie(user);
    }

    private void generateCookie(Models.User u)
    {
        HttpCookie userCookie = new HttpCookie("Ortund");
        userCookie.Values["userid"] = Convert.ToString(u.Id);
        userCookie.Values["fname"] = u.FirstName;
        userCookie.Values["lname"] = u.LastName;
        userCookie.Values["role"] = u.UserRole.RoleName;
        userCookie.Expires = DateTime.Now.AddYears(1);
        Response.Cookies.Add(userCookie);
    }

So why isn't this clearing my cookie?

EDIT

So now I've modified my code (see below) as per suggestions in the answers on the question.

I added in a Logout Action on my controller and it does this:

    public ActionResult Logout()
    {
        Session.Clear();
        HttpCookie userCookie = new HttpCookie("Ortund");
        userCookie.Expires = DateTime.Now.AddYears(-1);
        Response.Cookies.Add(userCookie);

        return View("Index");
    }

While my login still appears to work okay, the Request Cookie isn't updating with the new login details. Here's what it looks like after I do the login:

    Request.Cookies["Ortund"] {System.Web.HttpCookie} System.Web.HttpCookie  
    Domain null string  
    Expires {0001-01-01 12:00:00 AM} System.DateTime  
    HasKeys true bool  
    HttpOnly false bool  
    Name "Ortund" string  
    Path "/" string  
    Secure false bool  
    Shareable false bool

Answer 1

You need to write the expired cookie to the Response, not read and set it back to the Request.

var cookie = Request.Cookies["Ortund"];
cookie.Expires = DateTime.Now.AddSeconds(-1);
Response.Cookies.Add(cookie);

I would do some reading on how to implement Forms Authentication in c#. This will give you a better starting point then trying to roll your own authentication cookie which will lead to security holes. The standard forms authentication already has much to offer and a simple API to access it including ways to encrypt the ticket, provide identity information etc.

Alternatively you can also look into asp.net identity. This is Microsoft's newest API to managing identities and providing authentication and authorization. It also integrates with SSO like using Facebook or Microsoft identity stores to authenticate the user.

EDIT - based on request for more information

Here is some sample code using basic built in asp.net forms authentication. This example is cookie based. You would also need to configure the web.config to make use of it. Once this is done the rest happens automatically and you can get the user's information at any time using HttpContext.User.Identity. In the web.config you also need to add your decryption and validation keys.

public sealed class AuthController : Controller
{
    [AllowAnonymous] // get the view to login
    public ActionResult Login()
    {
        return View();
    }
    [HttpPost]
    [AllowAnonymous] // execute a login post
    public ActionResult ExecuteLogin(LoginModel model)
    {
        // validate credentials
        var ticket = new FormsAuthenticationTicket(1, model.UserName, DateTime.Now, DateTime.Now.AddHours(3), model.RememberMe, /*anything else you want stored in the ticket*/ null);
        var encryptedTicket = FormsAuthentication.Encrypt(ticket);
        var isSsl = Request.IsSecureConnection; // if we are running in SSL mode then make the cookie secure only

        var cookie = new HttpCookie(FormsAuthentication.FormsCookieName, encryptedTicket)
        {
            HttpOnly = true, // always set this to true!
            Secure = isSsl,
        };

        if (model.RememberMe) // if the user needs to persist the cookie. Otherwise it is a session cookie
            cookie.Expires = DateTime.Today.AddMonths(3); // currently hard coded to 3 months in the future

        Response.Cookies.Set(cookie);

        return View(); // return something
    }
    [Authorize] // a secured view
    public ActionResult SecuredView() {
        return View();
    }
    [Authorize] // log the user out
    public ActionResult Logout()
    {
        System.Web.Security.FormsAuthentication.SignOut();
        return RedirectToAction("Index", "Home");
    }
}

Here is the web.config changes

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
... 
  <system.web>
    <authentication mode="Forms">
      <forms name="myAuthCookie" ticketCompatibilityMode="Framework40" cookieless="UseCookies" requireSSL="false" timeout="180" protection="Encryption" />
    </authentication>
    <machineKey decryption="AES" decryptionKey="key here" validation="HMACSHA256" validationKey="validation key here" />
  </system.web>
</configuration>

Answer 2

you need to write the cookie again into the browser

HttpCookie userCookie = new HttpCookie("Ortund");
userCookie.Expires = DateTime.Now.AddYears(-1);
Response.Cookies.Add(userCookie);

and not only

Request.Cookies["Ortund"].Expires = DateTime.Now.AddSeconds(1);

a good explanation why, it's in my own answer from same time ago...