facing an issue with cookieless Forms Authentication in an ASP.NET sub-application that is integrated with a main application built in Python

Question

Hello,

We are facing an issue with cookieless Forms Authentication in an ASP.NET sub-application that is integrated with a main application built in Python.

The main application (Python) and sub-application (ASP.NET) work together.The ASP.NET sub-application uses Forms Authentication in cookieless mode (UseUri).When the main application logs out, it must also log out the sub-application by calling https://subapp.example.com/logout.aspx.The issue is that the sub-application is still accessible if the URL is available from developer tools after logging out from the main app.

Since the Forms Authentication is cookieless, I am unable to fetch the authentication cookie from the sub-application.

The only way to log out is by manually calling https://subapp.example.com/forms authentication cookie/logout.aspx, which works only if the sub-application explicitly uses FormsAuthentication.SignOut().However, since it’s cookieless, we cannot track the authentication ticket properly.

How can I fetch the authentication ticket (or simulate Forms Authentication logout) in a cookieless environment?

Is there a recommended way to enforce a complete logout across both applications?

Is there any way to programmatically invalidate the Forms Authentication ticket even if the URL remains accessible?

How to access the forms authentication token?

Looking for a way to invalidate the authentication ticket globally, but no success so far.

Would appreciate any suggestions or best practices to handle this!