We have, essentially, a custom asp.net application inside of SharePoint. We have a Logout button in the application that redirects to the _layouts/SignOut.aspx page. The user sees a message informing them they will need to close the browser to sign out and a message appears telling them the page is attempting to close the browser. If you do not close the browser windows and then click the back button, you can navigate back to the site and continue to perform actions.

log out message

This all make sense, however, now we have a requirement that the user, when they click logout, should be signed out completely without having to close the browser. Is there anyway to sign out of a session without having to close the browser? Is redirecting to the SignOut.aspx page not the 'SharePoint' way of doing this, or is there another way?

  • 4
    In case of a cookie, signing out will do the trick. But in case of AD login, the browser will automatically sign you in again as long as you didn't close it. Even so; when you've setup your site in the Intranet zone of IE, it will always try to sign in with your intranet credentials. So it depends on the sign in method you're using.
    – Jasper
    Apr 25, 2012 at 14:59

2 Answers 2


It all depends on which type of authentication scenarios you have in place. The SignOut.aspx clears those cookies (e.g. Sharepoint-KeepSessionAuthenticated) and abandon's session variables for the current user.

I've seen various solutions (e.g. http://social.msdn.microsoft.com/Forums/en/sharepointcustomization/thread/f9021dbf-59e2-4aca-b4fc-3f464b802df9) using Javascript calls to ClearAuthenticationCache or for Claims based authentication (which gets more complicated as in Chun Liu's article on MSDN)

private void RemoveCookiesAndSignOut()
    // Clear session state. 
    if (Context.Session != null)

    string cookieValue = string.Empty;
    if (Context.Request.Browser["supportsEmptyStringInCookieValue"] == "false")
        cookieValue = "NoCookie";

    // Clear my own cookie.
    HttpCookie cookieWinSignIn = Context.Request.Cookies["Morpheus_WindowsSignedIn"];
    if (cookieWinSignIn != null)
        cookieWinSignIn.Value = cookieValue;

    // Remove cookies for authentication. 
    HttpCookie cookieSession = Context.Request.Cookies["WSS_KeepSessionAuthenticated"];
    if (cookieSession != null)
        cookieSession.Value = cookieValue;

    HttpCookie cookiePersist = Context.Request.Cookies["MSOWebPartPage_AnonymousAccessCookie"];
    if (cookiePersist != null)
        cookiePersist.Value = cookieValue;
        cookiePersist.Expires = new DateTime(1970, 1, 1);

    // Sign out.

If you use Kerberos,ADFS,STS you will always notice there is a "FedAuth" cookie present in browsers except IE.So there is a need to clear the "Fedauth" cookie.

clearAuthenticationCache()-on logout click add script to clearauthenticationcache() in _layouts/Signout.aspx or create a custom signout page in SP and clearauthenticationcache() .but it works only with IE .

UPDATE easy way : Created a page viewer webpart on the landing page after you click signout . On the page viewer webpart call "/_layouts/signout.aspx" . If ADFS , call the adfs signout page . Set the height and weidth of the page viewer to 0 , so it is not visible .

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.