Question

If I call

FormsAuthentication.SignOut();

with a user logged in (with createPersistentCookie set to false on sign in) should I expect

HttpContext.Current.User.Identity.IsAuthenticated

to be false?

It isn’t, and Identity.Name still has a value. Is this right?

If this is normal behaviour, what do I need to do to remove all trace of a logged in user?

Edit: Is there someway to do what is necessary without doing a Response.Redirect?

Answer 1

The FormsAuthentication.SignOut method removes the forms-authentication ticket from the browser, so you need to first redirect and then query the HttpContext.Current.User.Identity.IsAuthenticated property.