Developer forum

Hi Nikolaj

Usually a 302 is a temporary redirect and not cached by the browser - so I wonder how you have ended there. We also send out 'expires -1' headers for 301s in most places to avoid browser caching despite 301 is permanent - but we have learned that most want a permanent redirect that is temporary :-).

I am thinking you can use web.config and add custom headers to the path handling the external login providers (/admin/public/Social).

Or directly in IIS:

We've tried that allready with no luck. The redirect is sending us to the AD login page "https://login.microsoftonline.com/" when ever we try to acces our site staging.vibocold.dk after trying to login with any user not in the AD domain, we get redirect to the AD login page.

If you want to see it, you can try going to staging.vibocold.dk and press the login in top right and then in the bottom of the login slide-in there is a Login as employee

We've tried that allready with no luck. The redirect is sending us to the AD login page "https://login.microsoftonline.com/" when ever we try to acces our site staging.vibocold.dk after trying to login with any user not in the AD domain, we get redirect to the AD login page.

If you want to see it, you can try going to staging.vibocold.dk and press the login in top right and then in the bottom of the login slide-in there is a Login as employee

More info
Azure setup

DW setup

Hi Nikolaj

I have looked into it and it is not browser cache that is causing this. DW sets a cookie, DW_ExtranetSessionCookie.DWExternalLoginProviderId when you start external authentication - no matter if it goes well or not. So DW expects you to login once you have chosen that option.

There is no easy fix.

You can remove or reset the DW_ExtranetSessionCookie if a user is not logged in - you can do that using a notification subscriber - something like below:

using Dynamicweb;
using Dynamicweb.Environment;
using Dynamicweb.Security.UserManagement;
using System;

namespace Dynamicweb.Examples.Notifications.Standard
{
    [Dynamicweb.Extensibility.Notifications.Subscribe(Dynamicweb.Notifications.Standard.Application.BeforeBeginRequest)]
    public class BeginRequestObserver : Dynamicweb.Extensibility.Notifications.NotificationSubscriber
    {
        public override void OnNotify(string notification, Dynamicweb.Extensibility.Notifications.NotificationArgs args)
        {
            if (args == null)
                return;

            if (!(args is Dynamicweb.Notifications.Standard.Application.BeforeBeginRequestArgs))
                return;

            Dynamicweb.Notifications.Standard.Application.BeforeBeginRequestArgs item = (Dynamicweb.Notifications.Standard.Application.BeforeBeginRequestArgs)args;

            if (!User.IsFrontendUserLoggedIn())
            {
                Cookie cookie = CookieManager.GetCookie("DW_ExtranetSessionCookie");
                bool isNewCookie = cookie is null;

                cookie = new Cookie("DW_ExtranetSessionCookie");
                cookie.Expires = DateTime.Now.AddDays(-100);
                cookie.HttpOnly = true;
                cookie["DWExternalLoginProviderId"] = null;

                if (isNewCookie)
                {
                    CookieManager.SetCookie(cookie);
                }
                else
                {
                    CookieManager.UpdateCookie(cookie);
                }

            }
        }
    }
}