title: Should I Use Session.Abandon() in my LogOff Method?
body: <p>Technologies I'm Using:</p>
  
  <ul>
  <li>MVC v2</li>
  <li>Forms Authentication (Sliding Expiration)</li>
  <li>Session State Server</li>
  <li>Custom Authorization Attribute</li>
  </ul>
  
  <p>I'm using the state server process for my mvc app.  During testing, when an authenticated user would click the "LogOff" button, it would correctly take them to the authentication screen, and upon successful credential entering, would log them back in.  BUT, it would find their prior session variable state, and NOT reload any new permissions I'd given them.  This is due to how I'm loading a user in the following code:</p>
  
  <pre><code>public override void OnAuthorization(AuthorizationContext filterContext) {
  
          if (filterContext == null)
              throw new ArgumentNullException("FilterContext");
  
          if (AuthorizeCore(filterContext.HttpContext)) {
              IUser customUser = filterContext.HttpContext.Session["CustomUser"] as IUser;
  
              if ((customUser == null) || (customUser.Name != filterContext.HttpContext.User.Identity.Name)) {
                  customUser = new User(filterContext.HttpContext.User.Identity.Name,
                                        filterContext.HttpContext.User.Identity.IsAuthenticated);
              }
  
              if (_privileges.Length &gt; 0) {
                  if (!customUser.HasAtLeastOnePrivilege(_privileges))
                      filterContext.Result = new ViewResult { ViewName = "AccessDenied" };
              }
  
              filterContext.HttpContext.Session["CustomUser"] = customUser;
          }
      }
  </code></pre>
  
  <p>So, you can see I'm storing my <code>customUser</code> in the <code>Session</code> and that value is what was fetched from the prior session even though the user had logged off between (but logged back on within the sliding expiration window.</p>
  
  <p>So, my question is, should I place a simple <code>Session.Abandon()</code> call in my <code>LogOff</code> method in the <code>AccountController</code>, or is there a cleaner more advantageous way of handling this?</p>