Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
In an ASP.NET 3.5 application running on IIS, how do I force a “deauthentication” of all currently logged-in and authenticated users?
iisreset didn’t seem to do the trick!
ASP.NET authentication is designed to be resilient to an IISReset due to its use of cookies – performing an IISReset will clear any in-memory information, but the next time a user asks for a page on your site, they will send their authentication token, which (if it hasn’t timed out) will still be valid, and the server will re-authenticate them.
You could write something that would effectively log out the user after a restart, by (for example) storing the application start time in a global variable in
Application_Start, and then comparing the usersLastActivityDatewith that value – if it’s before the start time, then you can call the appropriate sign-out method duringApplication_SessionStartorApplication_BeginRequest.