Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

We have, essentially, a custom asp.net application inside of SharePoint. We have a Logout button in the application that redirects to the _layouts/SignOut.aspx page. The user sees a message informing them they will need to close the browser to sign out and a message appears telling them the page is attempting to close the browser. If you do not close the browser windows and then click the back button, you can navigate back to the site and continue to perform actions.

log out message

This all make sense, however, now we have a requirement that the user, when they click logout, should be signed out completely without having to close the browser. Is there anyway to sign out of a session without having to close the browser? Is redirecting to the SignOut.aspx page not the 'SharePoint' way of doing this, or is there another way?

share|improve this question
4  
In case of a cookie, signing out will do the trick. But in case of AD login, the browser will automatically sign you in again as long as you didn't close it. Even so; when you've setup your site in the Intranet zone of IE, it will always try to sign in with your intranet credentials. So it depends on the sign in method you're using. –  Jasper Apr 25 '12 at 14:59

2 Answers 2

It all depends on which type of authentication scenarios you have in place. The SignOut.aspx clears those cookies (e.g. Sharepoint-KeepSessionAuthenticated) and abandon's session variables for the current user.

I've seen various solutions (e.g. http://social.msdn.microsoft.com/Forums/en/sharepointcustomization/thread/f9021dbf-59e2-4aca-b4fc-3f464b802df9) using Javascript calls to ClearAuthenticationCache or for Claims based authentication (which gets more complicated as in Chun Liu's article on MSDN)

private void RemoveCookiesAndSignOut()
{
    // Clear session state. 
    if (Context.Session != null)
    {
        Context.Session.Clear();
    }

    string cookieValue = string.Empty;
    if (Context.Request.Browser["supportsEmptyStringInCookieValue"] == "false")
        cookieValue = "NoCookie";

    // Clear my own cookie.
    HttpCookie cookieWinSignIn = Context.Request.Cookies["Morpheus_WindowsSignedIn"];
    if (cookieWinSignIn != null)
    {
        cookieWinSignIn.Value = cookieValue;
        Context.Response.Cookies.Remove("Morpheus_WindowsSignedIn");
        Context.Response.Cookies.Add(cookieWinSignIn);
    }

    // Remove cookies for authentication. 
    HttpCookie cookieSession = Context.Request.Cookies["WSS_KeepSessionAuthenticated"];
    if (cookieSession != null)
    {
        cookieSession.Value = cookieValue;
        Context.Response.Cookies.Remove("WSS_KeepSessionAuthenticated");
        Context.Response.Cookies.Add(cookieSession);
    }

    HttpCookie cookiePersist = Context.Request.Cookies["MSOWebPartPage_AnonymousAccessCookie"];
    if (cookiePersist != null)
    {
        cookiePersist.Value = cookieValue;
        cookiePersist.Expires = new DateTime(1970, 1, 1);
        Context.Response.Cookies.Remove("MSOWebPartPage_AnonymousAccessCookie");
        Context.Response.Cookies.Add(cookiePersist);
    }

    // Sign out.
    Microsoft.IdentityModel.Web.FederatedAuthentication.SessionAuthenticationModule.SignOut();
}
share|improve this answer

If you use Kerberos,ADFS,STS you will always notice there is a "FedAuth" cookie present in browsers except IE.So there is a need to clear the "Fedauth" cookie.

clearAuthenticationCache()-on logout click add script to clearauthenticationcache() in _layouts/Signout.aspx or create a custom signout page in SP and clearauthenticationcache() .but it works only with IE

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.