SimpleMembershipProvider不会在WebSecurity.SignOut之后销毁会话

Question

我正在使用所有默认会员代码运行ASP.NET MVC 4.AccountController的LogOff的代码是:

    [HttpPost]
    [ValidateAntiForgeryToken]
    public ActionResult LogOff()
    {
        WebSecurity.Logout();

        return RedirectToAction("Index", "Home");
    }

我注意到这段代码不会破坏会话,这意味着如果我使用一个帐户登录,将某些内容保存到会话中,然后注销并使用同一Web浏览器实例中的其他帐户登录,我仍然可以看到上一个用户的会话.

不知道为什么会这样.任何建议将不胜感激.谢谢.

Answer 1

Session和Authentification会话不是一回事.

在这里,您销毁了用户的身份验证,但您确实重新启动了ASP.NET会话.

更多解释:https://stackoverflow.com/a/1306932/971693

试着这样做:

[HttpPost]
[ValidateAntiForgeryToken]
public ActionResult LogOff()
{
    WebSecurity.Logout();

    Session.Abandon();

    // clear authentication cookie
    HttpCookie cookie1 = new HttpCookie(FormsAuthentication.FormsCookieName, "");
    cookie1.Expires = DateTime.Now.AddYears(-1);
    Response.Cookies.Add(cookie1);

    // clear session cookie (not necessary for your current problem but i would recommend you do it anyway)
    HttpCookie cookie2 = new HttpCookie("ASP.NET_SessionId", "");
    cookie2.Expires = DateTime.Now.AddYears(-1);
    Response.Cookies.Add(cookie2);


    return RedirectToAction("Index", "Home");
}