We have a problem with the .DOTNETNUKE cookie not being removed as it should when the user logout. We are not running a source installation on this site so we can only debug until the SignOut() is called in Logoff.aspx, but we can see that it is infact called. Because of other reasons, we have had to make a slight change to the web.config, could this be causing the problem:

<authentication mode="Forms">
      <forms name=".DOTNETNUKE" protection="All" timeout="60" cookieless="UseCookies" domain="mydomain.local" />
    </authentication>
     

If so, why isn't it working and what can we do to make it work (assuming this is the root of the fault)? When lookin in the code for SignOut() though, we can find no code for removing the .DOTNETNUKE cookies, only other cookies, where is the .DotNetNuke one removed?

We are using 5.6.3.

Upon closer investigation, this could be a problem with latest version of Firefox (and perhaps earlier as well). When using Google Chrome and executing the same code, it handles the cookie correctly (it removes it instantly once expired), Firefox however does not handle it correctly. Infact, the cookie is still there even after Firefox has been restarted altogheter, which is somewhat of a concern.

firefox has had consistent issues with not quite following the RFC's for security e.g. they ignore one of the cache directives to improve performance but that violates security. I'm not best convinced that it's a primary driver for them i.e. they take so much flak about speed/performance that they've concentrated on that in lieu of following correct security implementations.

---

Buy the new Professional DNN7: Open Source .NET CMS Platform book Amazon US