Question

I’m using ASP.NET Sitemaps with a custom Role Provider to generate a site Menu that displays available links depending on user role.

This works fine if the roles don’t change while a user is logged in.
When the roles do change while the user is logged in, the Menu isn’t automatically updated (I’ve checked, and the Roles.GetRolesForUser() is only called on login). This results in the user having access to the areas of the site he doesn’t have permission to see. This access is not only visual (in the form of the Menu items being displayed), but the access restrictions as defined in the Web.config are not being enforced either.

Is there a way to trigger the Menu/access control refresh when the roles are changed? Or do I need to force a logout?

Thanks in advance

EDIT: I just realized I had the Role Manager cacheRolesInCookie enabled, which meant that GetRolesForUser() was only being hit once and any further role checks were made using the cookie. Any way to refresh the cookie programmatically or do I have to live with the cache turned off? Maybe just removing the cookie will solve it?

Answer 1

Went for the non-cached version, which works fine.