title: How to invalidate a http session after logout
body: <p>I am creating a web application in asp.net mvc which is using forms authentication to authenticate users. 
  I am using a HTTP proxy tool "burp" to capture an authenticated users authenticated cookie. After that I logout from the application. Now I am using the captured authenticated cookie to send a request to my server and the server is treating the request as an authenticated request(even if logout for that user from my browser). 
  Could any one let me know where I am going wrong in my log out code?</p>
  
  <p>Below is my log out code of the application</p>
  
  <pre><code>  public virtual ActionResult LogOff()
      {
          FormsAuthentication.SignOut();
          Session.Abandon();
  
          // clear authentication cookie
          HttpCookie cookie1 = new HttpCookie(FormsAuthentication.FormsCookieName, "");
          cookie1.Expires = DateTime.Now.AddYears(-1);
          Response.Cookies.Add(cookie1);
  
          // clear session cookie 
          HttpCookie cookie2 = new HttpCookie("ASP.NET_SessionId", "");
          cookie2.Expires = DateTime.Now.AddYears(-1);
          Response.Cookies.Add(cookie2);
  
          HttpCookie cookie3 = new HttpCookie("__RequestVerificationToken", "");
          cookie3.Expires = DateTime.Now.AddYears(-1);
          Response.Cookies.Add(cookie3);
  
          HttpCookie cookie4 = new HttpCookie(".ASPXAUTH", "");
          cookie4.Expires = DateTime.Now.AddYears(-1);
          Response.Cookies.Add(cookie4);
  
  
          return RedirectToAction(MVC.Account.Login());
      }
  </code></pre>
  
  <p>Below is the screen shot of burp tool to send authenticated request which gives success response</p>
  
  <p><img src="https://i.stack.imgur.com/ncHbr.jpg" alt="Below is the screen shot of burp tool to send authenticated request which gives success response"></p>