> I am using the following code to log users out,
>
> FormsAuthetication.SignOut()
> Session.Abandon()
> Response.Redirect("Login.aspx")
> The signout method is removing the forms authentication cookie from
> the response headers that are sent back to the browser so the user is
> forced to login again. However, my security group was able to take a
> copy of the cookie and send it in a request to our server and was able
> to gain entry up until the forms authentication ticket times out on
> its own.
>
> Is there any way to programatically expire the forms authentication
> ticket on the server side? Or is there some configuration needed to
> make sure this is done when the user is logged out? Any help is
> appreciated.
>