I know this is an old post, but I wanted to document wherever this code exists that there is a better way of refreshing the user's roles cookie, which is with the PortalRoles.ClearRoles() shared method. If you call this line and then clear the user's cache, a subsequent page refresh will relaod the user's roles from the database.

Using the API is always a better way to work with the system if possible because it allows for changes to be made to the internal workings. I'm currently working on a resolution for the limit on the number of roles in which a user exists prior to the system falling over because of truncation of data (causing a decryption exception) in the user's roles cookie. That changes the contents of the cookie, and your code would cause failures in that instance.

To summarise,

C#

<code>
   //Clear the user's cached/stored role membership, will reload on next page cycle
   PortalSecurity.ClearRoles();
   DataCache.ClearUserCache(PortalId, UserInfo.Username);

   //Load the current roles into the user's current context for use in this page cycle
   RoleController roleControl = new RoleController();
   UserInfo.Roles = roleControl.GetRolesByUser(Me.UserId, Me.PortalId);
</code>

or VB

<code>
   'Clear the user's cached/stored role membership, will reload on next page cycle
   PortalSecurity.ClearRoles()
   DataCache.ClearUserCache(PortalId, UserInfo.Username)

   'Load the current roles into the user's current context for use in this page cycle
   Dim roleControl As New RoleController
   UserInfo.Roles = roleControl.GetRolesByUser(Me.UserId, Me.PortalId)
</code>

will cause a user's role list to be reloaded on the next page refresh. The third and fourth lines are only required when there is no redirect happening at the end of what you are doing, making the roles change visible in the current page cycle. Clearing the user's roles and the cache cause them to be reloaded automatically on the next page cycle, but depending on what you are doing that may be too late.

I hope this helps and finds favour with people! It's a more community-friendly way of working as it allows interoperability with custom membership HttpModules that may modify what the roles cookie contains. The current contents of the roles cookie are a problem for some people on large systems with many role memberships for each user, which makes the roles cookie contents a candidate for being changed in the future.