How to exit multiple asp.net applications?

Question

I have a main asp.net application that is written in asp.net 1.1. Running under the application - several applications 2.0. To completely log out, can I just log out of application 1.1 using FormsAuthentication.SignOut or is it harder than that?

Answer 1

What you want to do is called Single Sign On and Single Sign Off. There are differences based on application configuration. I will try to clarify where these differences come into play.

To implement single sign-on and single signing, you need to make the name, security, and cookie paths the same between all applications.

<authentication mode="Forms">
    <forms name=".cookiename"
           loginUrl="~/Login.aspx" 
           timeout="30" 
           path="/" />
</authentication>

, .

<machineKey validationKey="F9D1A2D3E1D3E2F7B3D9F90FF3965ABDAC304902"
            encryptionKey="F9D1A2D3E1D3E2F7B3D9F90FF3965ABDAC304902F8D923AC"
            validation="SHA1" />

? , , cookie:

protected void Login(string userName, string password)
{
    System.Web.HttpCookie cookie = FormsAuthentication.GetAuthCookie(userName, False);
    cookie.Domain = "domain1.com";
    cookie.Expires = DateTime.Now.AddDays(30);
    Response.AppendCookie(cookie);
}

, , FormsAuthentication.SignOut . - cookie . , cookie .

protected void Logout(string userName)
{
    System.Web.HttpCookie cookie = FormsAuthentication.GetAuthCookie(userName, False);
    cookie.Domain = "domain1.com";
    cookie.Expires = DateTime.Now.AddDays(-1);
    Response.AppendCookie(cookie);
}

, . , . , . .

Answer 2

, . .

Answer 3

This worked for me:

The Logout event uses the Cookies collection in the Request object instead of the FormsAuthentication.GetAuthCookie method, as shown below:

HttpCookie cookie = Request.Cookies.Get(otherSiteCookieName);
cookie.Expires = DateTime.Now.AddDays(-1);
HttpContext.Current.Response.Cookies.Add(cookie);

Of course, this requires that you know the cookie name of the site (s) in which you want the user to log out - which, however, will not be a problem if you use the same cookie in all web applications.

Answer 4

I prefer to use web.config

<authentication mode="Forms">
    <forms domain=".tv.loc" loginUrl="~/signin" timeout="2880" name="auth" />
</authentication>