Question

        Session.Clear();
        Session.Abandon();
        Session.RemoveAll();

        System.Web.Security.FormsAuthentication.SignOut(); 

I am doing this much code

still

HttpContext.Current.Session["User"]  is not null

🙁

Answer 1

You don’t need to call both Clear and RemoveAll. Here’s how the RemoveAll is implemented:

public void RemoveAll()
{
    this.Clear();
}

Also here’s a quote from KB 899918:

When the Web application requires a
logon and offers a log off page or
option, we recommend that you clear
the session state when the user has
logged off the Web site. To clear the
session state, call the
Session.Abandon method. The
Session.Abandon method lets you flush
the session state without waiting for
the session state time-out. By
default, this time-out is a 20-minute
sliding expiration. This expiration is
refreshed every time that the user
makes a request to the Web site and
presents the session ID cookie. The
Abandon method sets a flag in the
session state object that indicates
that the session state should be
abandoned. The flag is examined and
then acted upon at the end of the page
request. Therefore, the user can use
session objects within the page after
you call the Abandon method. As soon
as the page processing is completed,
the session is removed.