Should I Use Session.Abandon() in my LogOff Method?

Technologies I'm Using:

• MVC v2
• Forms Authentication (Sliding Expiration)
• Session State Server
• Custom Authorization Attribute

I'm using the state server process for my mvc app. During testing, when an authenticated user would click the "LogOff" button, it would correctly take them to the authentication screen, and upon successful credential entering, would log them back in. BUT, it would find their prior session variable state, and NOT reload any new permissions I'd given them. This is due to how I'm loading a user in the following code:

public override void OnAuthorization(AuthorizationContext filterContext) {

        if (filterContext == null)
            throw new ArgumentNullException("FilterContext");

        if (AuthorizeCore(filterContext.HttpContext)) {
            IUser customUser = filterContext.HttpContext.Session["CustomUser"] as IUser;

            if ((customUser == null) || (customUser.Name != filterContext.HttpContext.User.Identity.Name)) {
                customUser = new User(filterContext.HttpContext.User.Identity.Name,
                                      filterContext.HttpContext.User.Identity.IsAuthenticated);
            }

            if (_privileges.Length > 0) {
                if (!customUser.HasAtLeastOnePrivilege(_privileges))
                    filterContext.Result = new ViewResult { ViewName = "AccessDenied" };
            }

            filterContext.HttpContext.Session["CustomUser"] = custom开发者_Python百科User;
        }
    }

So, you can see I'm storing my customUser in the Session and that value is what was fetched from the prior session even though the user had logged off between (but logged back on within the sliding expiration window.

So, my question is, should I place a simple Session.Abandon() call in my LogOff method in the AccountController, or is there a cleaner more advantageous way of handling this?

Normally Session.Clear() should be enough and remove all values that have been stored in the session. Session.Abandon() ends the current session. It might also fire Session_End and the next request will fire Session_Start.