I\'m just wrapping up a college project, I\'m not sure if I\'ve been staring at my computer for too long and am missing something obvious, but when I try to log a user out, I\'m
You use a link (<a/>
tag) to log off which results in HTTP GET request when user clicks on it, but your action is constrained to serve POST request only (because it is decorated with [HttpPost]
attribute).
You either need to put your link into a form and generate POST request, or remove [HttpPost]
and [ValidateAntiForgeryToken]
(credits to GalacticCowboy) from your action.
I ran into this issue on a legacy app. The way that I fixed it was to detect when the supplied return Url was '/Account/LogOff' and act accordingly. From the 'AccountController.cs' file, 'Login' method:
if (returnUrl == "/Account/LogOff")
{
return this.RedirectToLocal(null);
}
else
{
return this.RedirectToLocal(returnUrl);
}
Since logout modifies server state, I wouldnt remove [HttpPost] and [ValidateAntiForgeryToken] Instead I will replace the link (anchor tag) with the following
@using (Html.BeginForm("Log Out", "Account", FormMethod.Post,
new { id = "logoutForm" }))
{
@Html.AntiForgeryToken()
<a href="javascript:document.getElementById('logoutForm').submit()">Log Out</a>
}