Hello,
http://stackoverflow.com/questions/17192502/asp-net-cookieless-how-to-delete-authentication-cookie
I just found that this link has exactly same issue like mine.
As long as user copies/pastes entire url(with auth cookie), he/she can log-in even after logging-out.
How do I prevent it?..Well..I guess the dirty(?) way would be I can keep track of user id and cooki auth value in the db so i can check against this db when authentication..however,
I don't want to take this way..
I think the problem is that the authenticated cookie value contains expiration date/userid..etc...information..so
when you pass exactly same authenticated cookie value in query string, it would log-in automatically..
Is there any way I can prevent this?
Thanks,
...
Go to the complete details ...