ASP.NET WebForms is still authenticated after singing out from Okta

Questions
1

Hi,

I have been running some tests using this webforms guide: https://developer.okta.com/blog/2018/08/29/secure-webforms-with-openidconnect-okta

and this sample project:

The problem I’m having is that, even if I have logged out from Okta, the sample application still shows me as authenticated.

My expectation is that, once I sign out from Okta, I should no longer be authenticated in the WebForms app, however, it still shows me as authenticated.

Not sure if I’m doing it wrong or if the sample code is wrong. I guess what’s needed here is to add some sort of check if the Okta session is still active.

Thanks,
Mikael

2

Sorry for the delay! We recently published some new Web Forms samples: https://github.com/okta/samples-aspnet-webforms

Can you try those and see if you still experience the issue?

3

Hi Nate,

Sorry for not getting back sooner, I have been on leave.

I have been running some tests with this sample:

However, this issue persists.
I sign in using the login button in the sample application, and I can see that I’m authenticated as a “Profile” button appears.

After that, I go to Okta and sign out from there. When I now return to the sample application, I am still authenicated. It does not help to close the application, restart visual studio and the browser, I’m still authenticated. The only way to sign out, is to click the “Logout” button on the sample application.

Thanks,
Mikael

4

I am having the same issue. Were you able to find a resolution?

I find that every issue with Okta is difficult to track down due to lack of support/working documentation.

5

I have a legacy .net 4.8 webforms application that is exhibiting this behavior. I don’t see any accepted resolution to this issue. Is there an update?

2 Likes
6

Same here … Web Forms, .Net 4.8.

… and when I try using the following on my logout page I get a 400. The only way to log out is by clearing browser cache.

Context.GetOwinContext().Authentication.SignOut(
OpenIdConnectAuthenticationDefaults.AuthenticationType);