Signout behavior without closing the browser?

Question

We have, essentially, a custom asp.net application inside of SharePoint. We have a Logout button in the application that redirects to the _layouts/SignOut.aspx page. The user sees a message informing them they will need to close the browser to sign out and a message appears telling them the page is attempting to close the browser. If you do not close the browser windows and then click the back button, you can navigate back to the site and continue to perform actions.

This all make sense, however, now we have a requirement that the user, when they click logout, should be signed out completely without having to close the browser. Is there anyway to sign out of a session without having to close the browser? Is redirecting to the SignOut.aspx page not the 'SharePoint' way of doing this, or is there another way?

Answer 1

It all depends on which type of authentication scenarios you have in place. The SignOut.aspx clears those cookies (e.g. Sharepoint-KeepSessionAuthenticated) and abandon's session variables for the current user.

I've seen various solutions (e.g. http://social.msdn.microsoft.com/Forums/en/sharepointcustomization/thread/f9021dbf-59e2-4aca-b4fc-3f464b802df9) using Javascript calls to ClearAuthenticationCache or for Claims based authentication (which gets more complicated as in Chun Liu's article on MSDN)

private void RemoveCookiesAndSignOut()
{
    // Clear session state. 
    if (Context.Session != null)
    {
        Context.Session.Clear();
    }

    string cookieValue = string.Empty;
    if (Context.Request.Browser["supportsEmptyStringInCookieValue"] == "false")
        cookieValue = "NoCookie";

    // Clear my own cookie.
    HttpCookie cookieWinSignIn = Context.Request.Cookies["Morpheus_WindowsSignedIn"];
    if (cookieWinSignIn != null)
    {
        cookieWinSignIn.Value = cookieValue;
        Context.Response.Cookies.Remove("Morpheus_WindowsSignedIn");
        Context.Response.Cookies.Add(cookieWinSignIn);
    }

    // Remove cookies for authentication. 
    HttpCookie cookieSession = Context.Request.Cookies["WSS_KeepSessionAuthenticated"];
    if (cookieSession != null)
    {
        cookieSession.Value = cookieValue;
        Context.Response.Cookies.Remove("WSS_KeepSessionAuthenticated");
        Context.Response.Cookies.Add(cookieSession);
    }

    HttpCookie cookiePersist = Context.Request.Cookies["MSOWebPartPage_AnonymousAccessCookie"];
    if (cookiePersist != null)
    {
        cookiePersist.Value = cookieValue;
        cookiePersist.Expires = new DateTime(1970, 1, 1);
        Context.Response.Cookies.Remove("MSOWebPartPage_AnonymousAccessCookie");
        Context.Response.Cookies.Add(cookiePersist);
    }

    // Sign out.
    Microsoft.IdentityModel.Web.FederatedAuthentication.SessionAuthenticationModule.SignOut();
}

Answer 2

If you use Kerberos,ADFS,STS you will always notice there is a "FedAuth" cookie present in browsers except IE.So there is a need to clear the "Fedauth" cookie.

clearAuthenticationCache()-on logout click add script to clearauthenticationcache() in _layouts/Signout.aspx or create a custom signout page in SP and clearauthenticationcache() .but it works only with IE .

UPDATE easy way : Created a page viewer webpart on the landing page after you click signout . On the page viewer webpart call "/_layouts/signout.aspx" . If ADFS , call the adfs signout page . Set the height and weidth of the page viewer to 0 , so it is not visible .