CODEWITHSUNDEEP
c#asp.netiisauthenticationasp.net-3.5
Deniz Dogan
Deniz Dogan

Reputation: 26217

ASP.NET/IIS: Log out all users

In an ASP.NET 3.5 application running on IIS, how do I force a "deauthentication" of all currently logged-in and authenticated users?

iisreset didn't seem to do the trick!

Upvotes: 4

Views: 5004

Answers (2)

Zhaph - Ben Duguid
Zhaph - Ben Duguid

Reputation: 26956

ASP.NET authentication is designed to be resilient to an IISReset due to its use of cookies - performing an IISReset will clear any in-memory information, but the next time a user asks for a page on your site, they will send their authentication token, which (if it hasn't timed out) will still be valid, and the server will re-authenticate them.

You could write something that would effectively log out the user after a restart, by (for example) storing the application start time in a global variable in Application_Start, and then comparing the users LastActivityDate with that value - if it's before the start time, then you can call the appropriate sign-out method during Application_SessionStart or Application_BeginRequest.

Upvotes: 5

Richard YS
Richard YS

Reputation: 1442

Changing the authentication form name will then require new authentication from all users.

From:

<authentication mode="Forms">
  <forms name="originalName" loginUrl="~/Account/Login"  />
</authentication>

To:

<authentication mode="Forms">
  <forms name="differentName" loginUrl="~/Account/Login"  />
</authentication>

Upvotes: 7

Related Questions