title: Implementing logging out with Windows Authentication as it's done in SharePoint: without closing the browser
body: <p>I'm developing a SOA-oriented Intranet application using WCF. I have to implement User Authentication with Windows Authentication.</p>
  
  <p>When we use Windows Authentication there is no possibility to really sign out without closing the browser. Only when you close the browser and open it again you get the browser prompt to enter user credentials. <strong>In my application I need user to be able to sign out without closing the browser.</strong>
  Nevertheless, it seems like there is some trick to change that behavior and if not really sign out than imitate it at least. It's implemented in SharePoint. 
  There are two options: "Sign Out" and "Sign in as a different user". "Sign Out" doesn't really sign out: it shows the prompt to close the browser. If you don't and just re-enter the address of your application than it's logged in as if nothing happened.
  However, "Sign in as a different user" DOES "log out" somehow. That is, after you pressed this button, you get browser prompts to enter your credentials when you try to access your application (WITHOUT closing browser).
  In all internet discussions it's clearly said (e.g. <a href="https://stackoverflow.com/questions/1067263/asp-net-windows-authentication-logout">here</a>) that it's NOT possible to log out using Windows Authentication. It seems like it's imitated in SharePoint by means of cookies. But I haven't succeeded in reverse engineering of this approach. Could you, please, suggest to me the way I can reproduce the SharePoint behavior in my services.</p>
  
  <p>I'm attaching the SharePoint request/response headers (from Chrome), maybe it can help you come out with some ideas (sorry for the large amount of text; and read ptth as http). Thanks!</p>
  
  <p><strong>1) Logged In User accessing any page:</strong>  </p>
  
  <pre><code>Request URL:ptth://tfs.somecompany.ru/sites/DefaultCollection/SomeProject/Dashboards/ProjectDashboard_wss.aspx
  Request Method:GET
  Status Code:200 OK
  
  Request Headers
  Accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
  Accept-Encoding:gzip,deflate,sdch
  Accept-Language:ru-RU,ru;q=0.8,en-US;q=0.6,en;q=0.4
  Cache-Control:max-age=0
  Connection:keep-alive
  Cookie:TSWA-Session-Vars=TFS-701396601=1055156467&amp;TFS-1638157380=1950326154; WSS_KeepSessionAuthenticated={46ec4974-b52c-4cc7-b157-84059d748740}
  Host:tfs.somecompany.ru
  If-Modified-Since:Wed, 26 Mar 2014 11:11:26 GMT
  User-Agent:Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1750.154 Safari/537.36
  
  Response Headers
  Cache-Control:private, max-age=0
  Content-Encoding:gzip
  Content-Length:44579
  Content-Type:text/html; charset=utf-8
  Date:Wed, 26 Mar 2014 11:11:51 GMT
  Expires:Tue, 11 Mar 2014 11:11:51 GMT
  Last-Modified:Wed, 26 Mar 2014 11:11:51 GMT
  MicrosoftSharePointTeamServices:14.0.0.6029
  Server:Microsoft-IIS/7.5
  Set-Cookie:WSS_KeepSessionAuthenticated={46ec4974-b52c-4cc7-b157-84059d748740}; path=/
  Set-Cookie:WSS_KeepSessionAuthenticated={46ec4974-b52c-4cc7-b157-84059d748740}; path=/
  Set-Cookie:TSWA-Session-Vars=TFS-701396601=1055156467&amp;TFS-1638157380=1950326154; path=/; HttpOnly
  Set-Cookie:WSS_KeepSessionAuthenticated={46ec4974-b52c-4cc7-b157-84059d748740}; path=/
  SPRequestGuid:db76867e-a1ff-4223-80e6-4502141c064a
  Vary:Accept-Encoding
  X-AspNet-Version:2.0.50727
  X-Powered-By:ASP.NET
  X-SharePointHealthScore:3
  </code></pre>
  
  <p><strong>2) Logged In User pressed "Sign Out":</strong></p>
  
  <pre><code>Request URL:ptth://tfs.somewebsite.ru/sites/DefaultCollection/SomeProject/_layouts/SignOut.aspx
  Request Method:GET
  Status Code:200 OK
  
  Request Headers
  Accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
  Accept-Encoding:gzip,deflate,sdch
  Accept-Language:ru-RU,ru;q=0.8,en-US;q=0.6,en;q=0.4
  Authorization:NTLM TlRMTVNTUAADAAAAGAAYAHwAAABUAVQBlAAAAAAAAABYAAAAEAAQAFgAAAAUABQAaAAAAAAAAADoAQAABYKIogYDgCUAAAAPL374PDZPX/Ete2OZtlmRrXYAcgBvAGQAawBpAG4AYQBCAEEAUgBCAEEAUgBBAC0AUABDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGR7rq4bit1H6OVC92tC/skBAQAAAAAAAE2zoPTkSM8Bp+dONwKxjtkAAAAAAgAeAFcASQBOAC0AOQBEAEMAUwBLAEUARgBHAEQAVABFAAEAHgBXAEkATgAtADkARABDAFMASwBFAEYARwBEAFQARQAEAB4AVwBJAE4ALQA5AEQAQwBTAEsARQBGAEcARABUAEUAAwAeAFcASQBOAC0AOQBEAEMAUwBLAEUARgBHAEQAVABFAAcACABNs6D05EjPAQYABAACAAAACAAwADAAAAAAAAAAAQAAAAAgAAAKREwkIhbBrQIu6920WSfsswbog8za6HpVEzgQnD0JbgoAEAAAAAAAAAAAAAAAAAAAAAAACQA0AEgAVABUAFAALwB0AGYAcwAuAGMAcgBvAHMAcwBpAG4AZgBvAHIAbQAuAHIAdQA6ADgAMAAAAAAAAAAAAAAAAAA=
  Connection:keep-alive
  Cookie:RSExecutionSession%3a%2fTfsReports%2fDefaultCollection%2fSomeProject%2fDashboards%2fBurndown=5po1uhfmxxnmnh45wshyam45; RSExecutionSession%3a%2fTfsReports%2fDefaultCollection%2fSomeProject%2fDashboards%2fBurn+Rate=wpajy3yqku1obhrhpuowv555; WSS_KeepSessionAuthenticated={46ec4974-b52c-4cc7-b157-84059d748740}; TSWA-Session-Vars=TFS-701396601=1055156467&amp;TFS-1638157380=1950326154
  Host:tfs.somewebsite.ru
  Referer:ptth://tfs.somewebsite.ru/sites/DefaultCollection/SomeProject/Dashboards/ProjectDashboard_wss.aspx
  User-Agent:Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1750.154 Safari/537.36
  
  Response Headers
  Cache-Control:private
  Content-Encoding:gzip
  Content-Length:3455
  Content-Type:text/html; charset=utf-8
  Date:Wed, 26 Mar 2014 11:17:21 GMT
  MicrosoftSharePointTeamServices:14.0.0.6029
  Persistent-Auth:true
  Server:Microsoft-IIS/7.5
  Set-Cookie:WSS_KeepSessionAuthenticated=; path=/
  SPRequestGuid:bffcf018-5667-4682-8a16-f3851cd2be98
  Vary:Accept-Encoding
  X-AspNet-Version:2.0.50727
  X-Powered-By:ASP.NET
  X-SharePointHealthScore:3
  </code></pre>
  
  <p><strong>3) After pressing "Sign out" enter: ptth://tfs.somewebsite.ru/sites/DefaultCollection/SomeProject/Dashboards/ProjectDashboard_wss.aspx
  (access is granted)</strong></p>
  
  <pre><code>Request URL:ptth://tfs.somewebsite.ru/sites/DefaultCollection/SomeProject/Dashboards/ProjectDashboard_wss.aspx
  Request Method:GET
  Status Code:200 OK
  
  Request Headers
  Accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
  Accept-Encoding:gzip,deflate,sdch
  Accept-Language:ru-RU,ru;q=0.8,en-US;q=0.6,en;q=0.4
  Connection:keep-alive
  Cookie:RSExecutionSession%3a%2fTfsReports%2fDefaultCollection%2fSomeProject%2fDashboards%2fBurndown=5po1uhfmxxnmnh45wshyam45; RSExecutionSession%3a%2fTfsReports%2fDefaultCollection%2fSomeProject%2fDashboards%2fBurn+Rate=wpajy3yqku1obhrhpuowv555; TSWA-Session-Vars=TFS-701396601=1055156467&amp;TFS-1638157380=1950326154; WSS_KeepSessionAuthenticated=
  Host:tfs.somewebsite.ru
  User-Agent:Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1750.154 Safari/537.36
  
  Response Headers
  Cache-Control:private, max-age=0
  Content-Encoding:gzip
  Content-Length:47367
  Content-Type:text/html; charset=utf-8
  Date:Wed, 26 Mar 2014 11:20:48 GMT
  Expires:Tue, 11 Mar 2014 11:20:48 GMT
  Last-Modified:Wed, 26 Mar 2014 11:20:48 GMT
  MicrosoftSharePointTeamServices:14.0.0.6029
  Server:Microsoft-IIS/7.5
  Set-Cookie:WSS_KeepSessionAuthenticated={46ec4974-b52c-4cc7-b157-84059d748740}; path=/
  Set-Cookie:WSS_KeepSessionAuthenticated={46ec4974-b52c-4cc7-b157-84059d748740}; path=/
  Set-Cookie:TSWA-Session-Vars=TFS-701396601=1055156467&amp;TFS-1638157380=1950326154; path=/; HttpOnly
  Set-Cookie:WSS_KeepSessionAuthenticated={46ec4974-b52c-4cc7-b157-84059d748740}; path=/
  SPRequestGuid:ad83778b-7689-4f7e-b789-9d005e5e9c6a
  Vary:Accept-Encoding
  X-AspNet-Version:2.0.50727
  X-Powered-By:ASP.NET
  X-SharePointHealthScore:3
  </code></pre>
  
  <p><strong>4) Logged In User pressed "Sign in as Different User": 
  ("logging out" happens - browser shows me the prompt to enter credentials)</strong></p>
  
  <pre><code>Request URL:ptth://tfs.somewebsite.ru/sites/DefaultCollection/SomeProject/_layouts/closeConnection.aspx?loginasanotheruser=true&amp;Source=http%3A%2F%2Ftfs%2Esomewebsite%2Eru%2Fsites%2FDefaultCollection%2FSomeProject%2FDashboards%2FProjectDashboard%5Fwss%2Easpx
  Request Method:GET
  Status Code:200 OK
  
  Request Headers
  Accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
  Accept-Encoding:gzip,deflate,sdch
  Accept-Language:ru-RU,ru;q=0.8,en-US;q=0.6,en;q=0.4
  Connection:keep-alive
  Cookie:RSExecutionSession%3a%2fTfsReports%2fDefaultCollection%2fSomeProject%2fDashboards%2fBurndown=5po1uhfmxxnmnh45wshyam45; RSExecutionSession%3a%2fTfsReports%2fDefaultCollection%2fSomeProject%2fDashboards%2fBurn+Rate=wpajy3yqku1obhrhpuowv555; loginAsDifferentAttemptCount=; previousLoggedInAs=; WSS_KeepSessionAuthenticated={46ec4974-b52c-4cc7-b157-84059d748740}; TSWA-Session-Vars=TFS-701396601=1055156467&amp;TFS-1638157380=1950326154
  Host:tfs.somewebsite.ru
  Referer:ptth://tfs.somewebsite.ru/sites/DefaultCollection/SomeProject/Dashboards/ProjectDashboard_wss.aspx
  User-Agent:Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1750.154 Safari/537.36
  Query String Parametersview sourceview URL encoded
  loginasanotheruser:true
  Source:ptth://tfs.somewebsite.ru/sites/DefaultCollection/SomeProject/Dashboards/ProjectDashboard_wss.aspx
  
  Response Headers
  Cache-Control:private
  Content-Encoding:gzip
  Content-Length:683
  Content-Type:text/html; charset=utf-8
  Date:Wed, 26 Mar 2014 11:29:27 GMT
  MicrosoftSharePointTeamServices:14.0.0.6029
  Server:Microsoft-IIS/7.5
  Set-Cookie:WSS_KeepSessionAuthenticated={46ec4974-b52c-4cc7-b157-84059d748740}; path=/
  SPRequestGuid:01cc0f78-c5af-48b0-a54a-ba214ccf3c0c
  Vary:Accept-Encoding
  X-AspNet-Version:2.0.50727
  X-Powered-By:ASP.NET
  X-SharePointHealthScore:3
  </code></pre>
  
  <p><strong>5) After pressing "Sign in as Different User" enter: ptth://tfs.somewebsite.ru/sites/DefaultCollection/SomeProject/Dashboards/ProjectDashboard_wss.aspx
  (access is denied - browser shows me the prompt to enter credentials again and after I press cancel I get the response)</strong></p>
  
  <pre><code>Request URL:ptth://tfs.somewebsite.ru/sites/DefaultCollection/SomeProject/Dashboards/ProjectDashboard_wss.aspx
  Request Method:GET
  Status Code:401 Unauthorized
  
  Request Headers
  Accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
  Accept-Encoding:gzip,deflate,sdch
  Accept-Language:ru-RU,ru;q=0.8,en-US;q=0.6,en;q=0.4
  Cache-Control:max-age=0
  Connection:keep-alive
  Cookie:loginAsDifferentAttemptCount=0; RSExecutionSession%3a%2fTfsReports%2fDefaultCollection%2fSomeProject%2fDashboards%2fBurndown=5po1uhfmxxnmnh45wshyam45; RSExecutionSession%3a%2fTfsReports%2fDefaultCollection%2fSomeProject%2fDashboards%2fBurn+Rate=wpajy3yqku1obhrhpuowv555; TSWA-Session-Vars=TFS-701396601=1055156467&amp;TFS-1638157380=1950326154; WSS_KeepSessionAuthenticated={46ec4974-b52c-4cc7-b157-84059d748740}; previousLoggedInAs=WIN-9DCSKEFGDTE+AFw-MyUserName; loginAsDifferentAttemptCount=1
  Host:tfs.somewebsite.ru
  User-Agent:Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1750.154 Safari/537.36
  
  Response Headers
  Content-Length:0
  Date:Wed, 26 Mar 2014 11:33:15 GMT
  MicrosoftSharePointTeamServices:14.0.0.6029
  Server:Microsoft-IIS/7.5
  SPRequestGuid:0d9863b0-9243-4762-bdb3-1ea49bec57e7
  WWW-Authenticate:NTLM
  X-Powered-By:ASP.NET
  </code></pre>
  
  <p><strong>Update 27.03.14</strong></p>
  
  <p>Found a way to imitate this behavior in Chrome and Opera without Cookies or anything. I just implement LogOut service operation like this: </p>
  
  <pre><code> public void LogOff()
          {
              WebOperationContext.Current.OutgoingResponse.StatusCode = HttpStatusCode.Unauthorized;
              WebOperationContext.Current.OutgoingResponse.Headers.Add("WWW-Authenticate", "NTLM");
          }
  </code></pre>
  
  <p>Check this <a href="http://forums.asp.net/t/1582668.aspx?Logging%20in%20as%20windows%20authenticated%20user%20with%20the%20option%20of%20changing%20who%20you%20are%20" rel="nofollow noreferrer">link</a>. Still have problems in Firefox though (doesn't prompt for authentication at all, always returns 401) and IE (doesn't log off, just refreshes the page, that's it).</p>