Suppose, if we have a password reset feature in our ASP.NET site
then the user should be forced to logged out once he chooses the new password, and
clicked save. He should be asked to login again and verify the new password.
When a user is already logged in, he can reach the form
PasswordReset.aspx and he can choose the new password. When the user types in
the new password and clicks save, the user is logged off by calling SignOut()
method of FormsAuthentication object. Refer to the code below.
Listing 13 - FormsAuthentication Signout Problem
int res = userDAO.ResetPassword(User.Identity.Name, txtOldPassword.Text,
txtConfirmPassword.Text);
lblMessage.Text = SUCCESSMSG;
FormsAuthentication.SignOut();
The actual problem is here. After the password reset is
successful the above code will log out the user as planned. But the LoginStatus
and LoginName controls on the page will still show the status of the user as
logged in as seen in Figure 3.
Figure 3 – Signout Problem
When the form is refreshed or for the subsequent server trip
the status of the user that is displayed on the form will be successfully
changed to logged out. The cause for this problem is even after the
FormsAuthentication.SignOut(); line execution the context information of the
current request will still hold the logged in user information. On executing
the line Context.User.Identity.Name, the signout code will still give the
logged in user information and thus LoginStatus control will not reflect the
logout change. From the next request Context.User.Identity.Name will have no
value in it which will make the login control to behave correctly.
The work around for the above problem will be making the
User attribute of Context object to null.
The final code is:
Listing 14 - FormsAuthentication Signout Problem
Resolution
int res = userDAO.ResetPassword(User.Identity.Name, txtOldPassword.Text,
txtConfirmPassword.Text);
lblMessage.Text = SUCCESSMSG;
FormsAuthentication.SignOut();
Context.User = null;
The other way of solving this problem is by redirecting the
user to the login page after changing the password. But you need to have some
logic to notify the user that the password is successfully changed.
