title: ASP.Net Session Not Invalidated After Logout
body: <p>I have a ASP.Net application in my login page I call </p>
  
  <pre><code>FormsAuthentication.SignOut 
  Session.Abandon() 
  Session.Clear() 
  </code></pre>
  
  <p>however the Appscan is taking the ASPXAUTH cookie value then after logout is able to re-inject the cookie value to gain access to protected pages.  </p>
  
  <p>Microsoft has acknowledged a problem but only offers advice not a fix - <a href="http://support.microsoft.com/kb/900111" rel="nofollow noreferrer">http://support.microsoft.com/kb/900111</a></p>
  
  <p>Can someone provide examples how to fix this issue</p>