Sanuja Ariyapperuma
Sanuja Ariyapperuma

Reputation: 466

Session persist for few minutes after log out ASP.NET

I have an ASP.NET 4.8 MVC application. I am using form authentications. Recently I have discovered that pages are accessible for a period of time 0-5min even after logged out.

This is only happening when using the BurpSuite tool with the help of Repeater. This is happening only for a time period of not more than 5 minutes. From the browser, it is 100% unable to access pages after logout. I am confused about how only the BurpSuite Repeater can access protected pages even after logging out.

I do not use any server caching.

public ActionResult Logout()
{
FormsAuthentication.SignOut();
// Abandon the session
Session.Abandon();

// Clear session state
Session.Clear();
Session.RemoveAll();
return RedirectToAction("Login", "Account");
}

Upvotes: 0

Views: 29

Answers (0)

Related Questions