How to force login after running the application?

Question

My scenario is this::

After authentication with Active Directory, the user who logged in is saved to a Session

[HttpPost]
public ActionResult Login(LoginModel model, string returnUrl)
{
    if (!this.ModelState.IsValid)
        return View(model);

    if (Membership.ValidateUser(model.Usuario, model.Senha))
    {
        Session.Add("Usuario", new UsuarioModel { Nome = "Eu", Login = "Filipe"});
        FormsAuthentication.SetAuthCookie(model.Usuario, false);
        if (this.Url.IsLocalUrl(returnUrl) && returnUrl.Length > 1 && returnUrl.StartsWith("/")
            && !returnUrl.StartsWith("//") && !returnUrl.StartsWith("/\\"))
        {
            return this.Redirect(returnUrl);
        }

        return this.RedirectToAction("Index", "Home");
    }

    this.ModelState.AddModelError(string.Empty, "O usuário ou a senha são inválidos");

    return View(model);
}

After that I make some changes to the code and run the application again, but Session does not remain there and the application considers that the user is still logged in.

How can I clean up this thing that makes the user still seem to be online?

Answer 1

Make the user leave the session in the event Application_End of your Global.asax.cs:

void Application_End(object sender, EventArgs e) 
{
    Session.Abandon();
}

PS: I have not tested this code.

---

EDIT

As the above code did not work, I think the programmatic way may not be a good output. In the file Web.config, amend the following:

<authentication mode="Forms">
    <forms cookieless="UseCookies" loginUrl="~/Account/Login" name="MinhaAutenticacao" slidingExpiration="true" timeout="300"/>
</authentication>

• timeout checks that the Cookie will last 5 minutes at most if the user is idle (i.e., without making any request to the server);
• slidingExpiration renews the expiration of the cookie if any request is made within five minutes.