title: Session management with ASP.NET MVC + IIS 6.0 + Basic Authentication
body: <p>I'll soon be embarking on a dev project with ASP.NET MVC (C#), but would like to first determine how to fix some of the shortcomings of our existing ASP classic applications in the new environment. Our intranet web servers are running IIS6 and for some reason (apparently due to the load balancer) the IT team has determined that Windows Integrated auth won't work and so we're stuck using basic. I'd love to do forms-based and query the AD, but that's not an option for security purposes. So the challenge is to mimic what can be done using forms-based authentication, but while actually using basic. In particular, being able to do something at least approximating logging out would be beautiful. The IT team's lead web developer said he gave up on trying to get that to work. It seems there's a lot of information on this out there, but much seems to be conflicting due to variations in configuration.</p>
  
  <p>Is there a best practice to achieve this, given our configuration?</p>
  
  <p>So far the best I've found would be to just do some kind of manual session tracking and then prompt for login info again by responding with a 401 if the 'session' has timed out, or if they had been marked as logged out and then visit the page again before closing and opening the browser. It seems like that would work, but is there a more elegant solution?</p>