Windows Identity Framework Signing out

When using claims based security and you implement the sign out functionality do not forget to delete the sessions cookie... otherwise when playing around with the back button you are able to sign in again... this is something you don't want...

	public class AuthenticationController : Controller
	{
	ILogger _Logger = NullLogger.Instance;
	public AuthenticationController(ILoggerFactory loggerfactory) {
	loggerfactory.Create(Loggers.Security);
	}
	[AllowAnonymous]
	public ActionResult Index()
	{
	return View();
	}
	//To trigger redirect to login
	[Authorize]
	public ActionResult SignIn()
	{
	return RedirectToAction("Index", "Home");
	}
	public void SignOut()
	{
	WsFederationConfiguration fc = FederatedAuthentication.FederationConfiguration.WsFederationConfiguration;
	string request = System.Web.HttpContext.Current.Request.Url.ToString();
	string wreply = request.Substring(0, request.Length - 7);
	SignOutRequestMessage soMessage = new SignOutRequestMessage(new Uri(fc.Issuer), wreply);
	soMessage.SetParameter("wtrealm", fc.Realm);
	SessionAuthenticationModule sam = FederatedAuthentication.SessionAuthenticationModule;
	if (sam != null) {
	_Logger.Debug("Calling SessionAuthenticationModule signout");
	sam.SignOut();
	sam.DeleteSessionTokenCookie();
	}
	WSFederationAuthenticationModule fam = FederatedAuthentication.WSFederationAuthenticationModule;
	if (fam != null) {
	_Logger.Debug("Calling WSFederationAuthenticationModule.Signout()");
	fam.SignOut();
	}
	_Logger.InfoFormat("Signed out. Redirecting...");
	Response.Redirect(soMessage.WriteQueryString());
	}
	}

view raw AuthenticationController.cs hosted with ❤ by GitHub

Loading ....