title: Can I delete ASP.NET authentication cookie (.ASPXAUTH) using JavaScript?
body: <p>Can I delete ASP.NET authentication cookie (.ASPXAUTH) using JavaScript? I would like to implement Sign Out functionality on my ASP.NET/JavaScript mobile application without a roundtrip to the server. However, this approach does not work for some reason. </p>
  
  <pre><code>document.cookie = '.ASPXAUTH=; expires=Thu, 01-Jan-70 00:00:01 GMT;';
  </code></pre>
  
  <p>What should I do? </p>
  
  <p>Thank you.</p>
  
  <p>UPDATE: Okay, I read about a HttpOnly cookies, and it is the very case. In order to make the cookie not a HttpOnly, add the following line to web.config (system.web section): </p>
  
  <pre><code>&lt;httpCookies httpOnlyCookies="false"/&gt;
  </code></pre>
  
  <p>UPDATE: The method above does not work -- ASP.NET simply ignores the instruction. I ended up doing this hack in Global.asax: </p>
  
  <pre><code>protected void Application_EndRequest(Object sender, EventArgs e)
  {
      string cookieName = System.Web.Security.FormsAuthentication.FormsCookieName;
      if (Response.Cookies.Count &gt; 0)
      {
          foreach (string s in Response.Cookies.AllKeys)
          {
              if (s == cookieName)
              {
                  Response.Cookies[cookieName].HttpOnly = false;
              }
          }
      }
  }
  </code></pre>