title: Issues with ASP.NET Forms Authentication on Phonegap (Android)
body: <p>I have an ASP.NET MVC/Web API backend where I have implemented a Forms Authentication for my Phonegap app. The login is executed by sending the users credentials via jQuery Ajax call like this:</p>
  
  <pre><code>$.ajax({
      type: "POST",
      url: "/api/authentication/login",
      data: JSON.stringify({ Username: username, Password: password }),
      contentType: "application/json; charset=utf-8",
      dataType: "TEXT",
      statusCode: {
          200: function (response, status, xhr) {
              // successfully authenticated
              Backbone.history.navigate("/", { trigger: true });
          }
      }
  });
  </code></pre>
  
  <p>The backends login method looks like this:</p>
  
  <pre><code>[ActionName("login")]
  [AllowAnonymous]
  public LoginResult Login(LoginCredentials credentials)
  {
      // doing all kinds of things here
  
      // if valid credentials
      FormsAuthentication.SetAuthCookie(loginID, true);
      return loginResult;
  }
  </code></pre>
  
  <p>I have this in my Web.config:</p>
  
  <pre><code>&lt;authentication mode="Forms"&gt;
    &lt;forms
      name=".ASPXAUTH"
      loginUrl="/login"
      defaultUrl="/home"
      protection="All"
      slidingExpiration="true"
      timeout="525600"
      cookieless="UseCookies"
      enableCrossAppRedirects="false"
      requireSSL="true"
      &gt;
    &lt;/forms&gt;
  &lt;/authentication&gt;
  </code></pre>
  
  <p>Now the problem with Android here is that the cookie is properly set and it does work on my authorized methods after the login, but sometimes (often) when I close the app and open it again, I'm no longer logged in. The cookie isn't there anymore, I can not see it in the request. This should not happen because I have set the timeout to 525600. I have noticed that this problem often occurs when I close the app immediately after login. In other hand if I log out and then log in without closing the app, the cookie is saved properly.</p>
  
  <p>But, if I get the cookie to stick, most of the time the logout behaves strangely as well. This is how I do the logout request:</p>
  
  <pre><code>$.ajax({
      type: "POST",
      url: "/api/authentication/logout",
      data: "{}",
      contentType: "application/json; charset=utf-8",
      dataType: "text"
      success: function (response) {
          // successfully logged out
          Backbone.history.navigate("api/login", { trigger: true });
      }
  });
  </code></pre>
  
  <p>The backend:</p>
  
  <pre><code>[ActionName("logout")]
  [AllowAnonymous]
  public String Logout()
  {
      FormsAuthentication.SignOut();
  
      HttpCookie cookie = new HttpCookie(FormsAuthentication.FormsCookieName, "");
      cookie.Expires = DateTime.Now.AddYears(-1);
      HttpContext.Current.Response.Cookies.Add(cookie);
  
      return "home";
  }
  </code></pre>
  
  <p>Now similar to the problem with the login, the logout first seems to be successful and the cookie is no longer sent with any requests. But when I close the app and open it again, the cookie is back and I'm logged in again. I can see that the cookie has the same value as the one I thought I just removed by setting its expiration time to the past.</p>
  
  <p>I have tried all kinds of tricks, like:</p>
  
  <ul>
  <li>extra reloads after the login/logout (<code>location.reload()</code>)</li>
  <li>executing the logout/login request multiple times</li>
  <li>executing request to other methods after the login/logout</li>
  <li>1-10 second timeout between the login/logout request and the reload</li>
  <li>all kinds of variations of the above</li>
  </ul>
  
  <p>The authentication works as intended on iOS and Windows Phone. The problem occurs only on Android (tested on KitKat and Lollipop). No problem on the Android emulator, but on real devices and Visual Studios Android emulator this happens all the time.</p>
  
  <p>I don't know in which direction to go from here. Is there something in the Android WebView that could cause this kind of behavior? Is there something else I could test out? Please help!</p>
  
  <p>I'm more than happy to give more information if needed.</p>
  
  <p><strong>EDIT:</strong>
  Inspired by Fabian's comment, I changed the logout method to this:</p>
  
  <pre><code>FormsAuthentication.SignOut();
  
  HttpCookie cookie = HttpContext.Current.Response.Cookies[FormsAuthentication.FormsCookieName];
  cookie.Expires = DateTime.Now.AddYears(-1);
  HttpContext.Current.Response.Cookies.Clear();
  HttpContext.Current.Response.Cookies.Add(cookie);
  
  return "home";
  </code></pre>
  
  <p>Instead of creating a new cookie, I used the one in the response. It did not work.</p>
  
  <p>I also tried something I found from here: <a href="http://techblog.dorogin.com/2013/01/formsauthentication-gotcha-with-signout.html" rel="noreferrer">http://techblog.dorogin.com/2013/01/formsauthentication-gotcha-with-signout.html</a> That also did no difference, the path was not the problem. Still looking for a solution.</p>
  
  <p><strong>ANOTHER EDIT:</strong>
  Still not able to find a solution for this. I had to make a horrible workaround.</p>
  
  <ul>
  <li><strong>Login:</strong> I make two reloads after the login and then a request to
  a dummy method. This seems to work every time.</li>
  <li><strong>Logout:</strong> I use a flag placed in localStorage to determine if the user has logged out and perform a logout in the startup. This always removes the cookie correctly.</li>
  </ul>
  
  <p>I'm not happy with these hacks and I'm still hoping for a better solution.</p>