Cannot log out user when leaving and coming back to app

[Sacha Korell]

My customer wants a user to be logged out of the system when he uses the
same browser to navigate to a different
website (without explicitly logging out). In other words, if the user
navigates to a different website and uses the "Back" button to get back to
my application, he should have to log in again.

I know that I can detect on the client when the user navigates to another
website (Body OnUnload=) but I don't know how to go from here. Even when I
use the log out code in the procedure that gets called on unload (when the
user navigates to a different website), the user can just hit the "Back"
button the browser and be back in the application.

Can this be accomplished?

Thanks,

Sacha

 

[MasterGaurav]

Do you mean browsing by clicking a link at your website or directly?

If it's by clicking a link: you can redirect using like
"redirect.aspx?url=<url>" and redirect.aspx can do the logout job.

Using, onunload, you'll need to a small popup that will do the logout.
Note that now browsers are very strict on popups.

Or I'm not sure if the following works:
onunload="logout()"

javascript function:

function logout()
{
document.cookies[".ASPXAUTH"] = null;
}

// Basically, you need to remove the .ASPXAUTH cookie or whatever name
you've set in web.config file.


--
Cheers,
Gaurav Vaish
http://www.mastergaurav.org
http://mastergaurav.blogspot.com
----------------------

 

[Sacha Korell]

Yes, I meant navigating to a different site directly. I will try your
suggestion "document.cookies[".ASPXAUTH"] = null;" on Monday. That sounds
like it might work.

Thanks!

Sacha

 

[Sacha Korell]

Yes, I meant navigating to a different site directly. I will try your
suggestion "document.cookies[".ASPXAUTH"] = null;" on Monday. That sounds
like it might work.

Thanks!

Sacha

 

[MasterGaurav]

Just check the syntax in javascript. I'm not sure if it should be "=
null" or something else.

--
Cheers,
Gaurav Vaish
http://www.mastergaurav.org
http://mastergaurav.blogspot.com
----------------------

 

[Sacha Korell]

Thanks Gaurav, but the "document.cookie[".ASPXAUTH"] = null;" didn't seem to
work. I called the cookie before and after that line and got the same
content.
I am logging the user out after OnUnload fires by calling a postback event
and then "FormsAuthentication.SignOut()", but when the user returns back to
my web app, he can still navigate everywhere.

Now, I'm trying to see whether I can detect the difference between a browser
closing and navigating to a different URL. Do you know if that is possible?

Thanks,

Sacha

 

[MasterGaurav]

I was suspecting.. that's why I recommended to read javascript as well.
;-)

Anyway.. you can do this:

document.cookie = ".ASPXAUTH=deleted; path=/ ; domain = yourdomain.com"

Basically, what matters is the value of the cookie. It should be
invalid, that's it.


--
Cheers,
Gaurav Vaish
http://www.mastergaurav.org
http://mastergaurav.blogspot.com
----------------------