title: Invalidating ASP.NET FormsAuthentication server side
body: <p>I am experimenting with FormsAuthentication (using ASP.NET MVC2) and it is working fairly well.</p>
  
  <p>However, one case I can't work out how to deal with is validating the user identity on the server to ensure it is still valid from the <em>server's</em> perspective.</p>
  
  <p>eg.</p>
  
  <ol>
  <li>User logs in ... gets a cookie/ticket</li>
  <li>Out of band the user is deleted on the server side</li>
  <li>User makes a new request to the server.  HttpContext.User.Identity.Name is set to the deleted user.</li>
  </ol>
  
  <p>I can <em>detect</em> this fine, but what is the correct way to handle it?  Calling <code>FormsAuthentication.SignOut</code> in the <code>OnAuthorization</code> on <code>OnActionExecuting</code> events is too late to affect the current request.</p>
  
  <p>Alternatively I would like to be able to calls FormsAuthentication.InvalidateUser(...) when the user is deleted (or database recreated) to invalidate all tickets for a given (or all) users.  But I can't find an API to do this.</p>