ASP.NET MVC FormsAuthentication.SignOut 不起作用
我正在尝试使用 forms.signout 但有时它不会注销用户，他仍然可以浏览网站。
我该如何解决这个问题？我还配置了 web.config 表单身份验证，但它仍然无法正常工作。
我正在使用 FormsAuthentication 来验证用户的登录信息。
谢谢！！
I'm trying to use forms.signout but sometimes it does not log out the user and he still can navegates through the website.
How can I resolve this? I also configured web.config forms authentication, but it's still not working.
I'm using FormsAuthentication to autenticate an user passing he's login.
Thanks!!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
我不知道原因是什么，但您可能会考虑/尝试一些事情
他们实际上仍然能够访问服务器生成的页面还是只是返回到本地缓存的版本？当他们引发回发并使用代码来检查他们是否经过身份验证时，会发生什么情况？我认为后者意味着他们已注销，但正在查看登录页面的缓存版本，在这种情况下，您希望指示客户端不要缓存页面，例如：
Response.Cache.SetExpires(DateTime.UtcNow.AddMinutes(-1));
Response.Cache.SetCacheability(HttpCacheability.NoCache);
Response.Cache.SetNoStore();
您可以尝试手动将 cookie 设置为过期，但这是一种黑客行为
FormsAuthentication.SignOut();
Context.Response.Cookies.Item(FormsAuthentication.FormsCookieName).Expires = Date.Now;
Response.Redirect("~/Somewhere.aspx");
I don't know what the cause is but a few things you might consider/try
are they actually able to still visit pages generated by the server or are they just going back to locally cached versions? What happens when they cause a postback that has code to check if they are authenticated does that work or does it fail? I think the later meaning they are signed out but viewing cached versions of the logged in page in which case you want to instruct the client not to cache the pages using for instances:
Response.Cache.SetExpires(DateTime.UtcNow.AddMinutes(-1));
Response.Cache.SetCacheability(HttpCacheability.NoCache);
Response.Cache.SetNoStore();
You can try manually setting the cookie to be expired but this is a hack
FormsAuthentication.SignOut();
Context.Response.Cookies.Item(FormsAuthentication.FormsCookieName).Expires = Date.Now;
Response.Redirect("~/Somewhere.aspx");
用户的受信任站点或 Intranet 站点中是否有该域（或父域）？我最近遇到了一些问题，用户经过身份验证，但在这种情况下是匿名的。就我而言，也可能是父站点曾经配置为允许 Windows 集成身份验证。我已经删除了它，但它似乎对解决问题没有帮助。我还没有重新启动 IIS 来看看这是否有效果。我已经采取检查用户是否经过身份验证和非匿名的方式来确保呈现视图的正确部分。尽管我的登录代码应该阻止匿名登录，但这实际上更准确。
Does the user have the domain (or a parent domain) in their trusted sites or intranet sites? I've run into some issues recently where a user is authenticated, but anonymous under circumstances where this is true. In my case it could also be that a parent site was, at one time, configured to allow windows integrated authentication. I've removed since removed that, but it didn't seem to help the problem. I haven't yet restarted IIS to see if this would have an effect. I've resorted to checking both that the user is authenticated and non-anonymous to ensure that the proper parts of the view are rendered. This is actually more accurate even though my login code should prevent having an anonymous login.