CODEWITHSUNDEEP
saml-2.0adfs2.0
Dilip
Dilip

Reputation: 747

ADFS cookies not getting clear after successful logout

we are using ADFS for SSO , when we successful logging out from our app using this URL https://XXXXX/adfs/ls/?wa=wsignout1.0 we deleting all application level cookies , but once user clicking on back buttion in browser its user able to login in application again . enter image description here

we can see there some ADFS related cookies which we cant delete from app. any suggestion to solve this issue .

Upvotes: 2

Views: 6350

Answers (2)

Gaurav Gupta
Gaurav Gupta

Reputation: 373

You are using the wrong endpoint for the logout. The endpoint for SAML logout is: https://XXXXX/adfs/ls/{your_saml_logout_request}. The endpoint with "?wa=wsignout1.0" is for ws-federation logout and doesn't actually clears the cookie for the SAML login session. To get the SAML logout working do check your hashing algorithm matches for the SP and the ADFS. Also, your logout request should be signed.

Upvotes: 1

Bill Berlington
Bill Berlington

Reputation: 2414

I faced a similar issue. Now I am clearing my Azure AD auth cookies like this. Maybe its not the best solution, but it works

 while (Request.Cookies["MyCookie"] != null && Request.Cookies["MyCookie1"] != null)
        {
            Request.Cookies["MyCookie"].Expires = DateTime.Now.AddDays(-5);
            Response.Cookies.Add(new HttpCookie("MyCookie"));
            Request.Cookies["MyCookie1"].Expires = DateTime.Now.AddDays(-5);
            Response.Cookies.Add(new HttpCookie("MyCookie1"));                
        }

Upvotes: 0

Related Questions