We are using Sitecore 9.3. We have login and logout features in our site using Azure AD B2C.
During logout, we are performing below operations in that order -
- We send request to Azure AD B2C to logout and send a post logout redirect url
- Delete the cookie -
In the penetration test done on the site, it was found that even after logging out, calling -
.ASPNet.Cookies in the header is giving
200 OK response.
Can anyone please suggest why is application still accepting the value of
.AspNet.Cookies cookie? How to prevent this behavior?