How to prevent re-use of authorization after logout
<p>I have a project in C# which has some administrative functions behind a login screen.</p>

<p>During a recent pentest, we were dinged with a potential for attack: if the user submits a form, logs out, and the form post is repeated (using burp or a similar tool) the server still sees them as logged in and responds correctly.</p>

<p>The entire 'Admin' controller is set to <code>[Authorize]</code> with appropriate roles set.  On logout, I am calling</p>

<pre><code>FormsService.SignOut();
Session.Clear();
Session.Abandon();
</code></pre>

<p>and redirecting the user to a start page.</p>

<p>Everything I have read indicates that this should be all I need to do to prevent this from happening.  That said, I can do the following:</p>

<ol>
<li>Log on to my administration area</li>
<li>Perform a search (a JSON POST action, captured in burp)</li>
<li>See search results</li>
<li>Logout</li>
<li>Repeat the JSON POST in burp (which contains an '.ASPXAUTH' cookie)</li>
<li>See a server response in burp which matches the earlier response</li>
</ol>

<p>What can I do to prevent this?</p>