Sunday, 15 January 2012

javascript - Cookie staying around after I delete it and refresh -



javascript - Cookie staying around after I delete it and refresh -

i'm trying remove user's authentication cookie using $cookiestore.remove('.aspxauth'), if refresh page afterwards, cookie still exists , page still available instead of user beingness redirected login page expect.

why user still able view page after delete authentication cookie , refresh page?

i'm afraid there isn't much can http-only cookie javascript. backend has remove if it's http-only. can trigger logout using ajax.

$http.get("/logout");

the other alternative utilize non http cookie can modify javascript. create vulnerable , unsafe risk of xss flaw grabbing cookie , allowing session hijacked.

ps: seek head request method if don't want load page follows (might work "do-and-forget-about-it")

$http.head("/logout");

javascript angularjs asp.net-mvc-4 cookies cookiestore

No comments:

Post a Comment