hi
Im using Form Authentication on my site and use a LoginStatus control to allow user sign off.
I have a admin page named admin.aspx in admin folder under application's root.
The admin page is for Administrator role only, any users in other roles will be shown "you are unauthorized" message.
There is no hyperlink on any page link to the admin page, administrators must type url in browser address bar to access the admin page, and when an administrator log out, he/she will be redirected to an "log out" page showing the user is logged out successfully.
Here my problem comes, after an administrator log out , if an anonymous user select the Admin page's url in IE's address bar (the brower is not closed after log out) , the anonymous user can open the Admin page! Feels like the administrator's FormAuthentication token(the cookie) is not destoried after sign off and reused be the anonymouse user. However, i ...
Go to the complete details ...