Re: How to terminate client logon? session.abandon not working?

From: Tom Kaminski [MVP] ((A_at_T))
Date: 07/12/04


Date: Mon, 12 Jul 2004 14:37:51 -0400


"Todd Johnson" <tjohnson@cgisenior.com> wrote in message
news:%23V7xl1DaEHA.2488@tk2msftngp13.phx.gbl...
> It seems that we can wipe out the session vars, but not the
authentication.
>
> How do we terminate the authentication and force the user to logon again?
> Is the old session ID still valid after the abandon?

That's because client authentication is not at all related to the ASP
session. The browser caches the client credentials locally. Aside from
closing the browser to kill the cache you may try:
http://support.microsoft.com/?kbid=195192

-- 
Tom Kaminski IIS MVP
http://www.microsoft.com/windowsserver2003/community/centers/iis/
http://mvp.support.microsoft.com/
http://www.iisfaq.com/
http://www.iistoolshed.com/ - tools, scripts, and utilities for running IIS
http://www.tryiis.com


Relevant Pages

  • Re: HELP Connection error on Release mode
    ... "Off" Always display detailed ASP.NET error information. ... This section sets the authentication policies of the application. ... Set trace enabled="true" to enable application trace logging. ... <!-- SESSION STATE SETTINGS ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: Session Fixation Vulnerability in Web-based Applications
    ... session, without modifying the way servers generate session ID's is as ... Think of the http server generated sessions as "UI Sessions" and as ... no impact on authentication. ... "authentication key" for this domain (usually in the form of a new ...
    (NT-Bugtraq)
  • Re: [PHP] Re: a question on session ID and security
    ... constructed to produce the actual authentication token. ... looking at the cookies on the client gets no indication that you're ... testing for remote session hijacking weaknesses. ... blinded by a bright shiny new algorithm. ...
    (php.general)
  • Re: Forms authentication vs session variable
    ... There is a known security vulnerability called "Session Hijacking", ... and there are standard ways of protection. ... With forms authentication being the standard approach, ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Forms authentication vs session variable
    ... There is a known security vulnerability called "Session Hijacking", ... and there are standard ways of protection. ... With forms authentication being the standard approach, ...
    (microsoft.public.dotnet.framework.aspnet)

Quantcast