zoukankan      html  css  js  c++  java
  • FormsAuthentication.SignOut() does not log the user out

    FormsAuthentication.SignOut() does not log the user out

    这个应该不能解决官方文档提到的replay attack问题

    Users can still browse your website because cookies are not cleared when you call FormsAuthentication.SignOut() and they are authenticated on every new request. In MS documentation is says that cookie will be cleared but they don't, bug? Its exactly the same with Session.Abandon(), cookie is still there.

    You should change your code to this:

    FormsAuthentication.SignOut();
    Session.Abandon();
    
    // clear authentication cookie
    HttpCookie cookie1 = new HttpCookie(FormsAuthentication.FormsCookieName, "");
    cookie1.Expires = DateTime.Now.AddYears(-1);
    Response.Cookies.Add(cookie1);
    
    // clear session cookie (not necessary for your current problem but i would recommend you do it anyway)
    SessionStateSection sessionStateSection = (SessionStateSection)WebConfigurationManager.GetSection("system.web/sessionState");
    HttpCookie cookie2 = new HttpCookie(sessionStateSection.CookieName, "");
    cookie2.Expires = DateTime.Now.AddYears(-1);
    Response.Cookies.Add(cookie2);
    
    FormsAuthentication.RedirectToLoginPage();

    HttpCookie is in the System.Web namespace. MSDN Reference.

    FormsAuthentication.SignOut Method

    Removes the forms-authentication ticket from the browser.

    Remarks

    The SignOut method removes the forms-authentication ticket information from the cookie or the URL if CookiesSupported is false. You can use the SignOut method in conjunction with the RedirectToLoginPage method to log one user out and allow a different user to log in.

    If you run exclusively in cookieless mode, or if you support both authenticated and anonymous users, you should explicitly control the redirect to the login page if you require special business logic to execute as a result of removing the anonymous identifier.

    When the SignOut method is called, a redirect to the application's login page is made by calling the Redirect method with the endResponse parameter set to false. The redirect does not take place until the current page has finished executing, so additional code can be run. If the code does not contain an explicit redirect to another page, the user is redirected to the login page configured in the application's configuration file.

    Calling the SignOut method only removes the forms authentication cookie. The Web server does not store valid and expired authentication tickets for later comparison. This makes your site vulnerable to a replay attack if a malicious user obtains a valid forms authentication cookie. To improve security when using a forms authentication cookie, you should do the following:

    • Use absolute expiration for forms authentication cookies by setting the SlidingExpiration property to false. This limits the window in which a hijacked cookie can be replayed.

    • Only issue and accept authentication cookies over Secure Sockets Layer (SSL), by setting the RequireSSL property to true and by running the entire Web site under SSL. Setting the RequireSSL property to true ensures that ASP.NET will never send an authentication cookie to the browser over a non-SSL connection; however, the client might not honor the secure setting on the cookie. This means the client might send the forms authentication cookie over a non-SSL connection, thus leaving it vulnerable to hijack. You can prevent a client from sending the forms authentication cookie in the clear by running the entire Web site under SSL.

    • Use persistent storage on the server to record when a user logs out of the Web site, and then use an application event such as PostAuthenticateRequest event to determine whether the current user was authenticated with forms authentication. If the user was authenticated with forms authentication, and if the information in persistent storage indicates the user is logged out, immediately clear the authentication cookie and redirect the browser back to the login page. After a successful login, update storage to reflect that the user is logged in. When you use this method, your application must track the logged-in status of the user, and must force idle users to log out.

  • 相关阅读:
    redhat 7.2 内网安装docker
    使用dockerfile 创建ubuntu ssh镜像
    docker 离线环境安装oracle
    redhat 6.6 、7、Centos7离线安装docker
    用命令行管理aws s3
    Anaconda介绍、安装及使用教程
    python2 编码问题万能钥匙
    从mongo数据库中导出数据的方法
    MongoDB学习第三篇 --- Insert操作
    MongoDB学习笔记(一)-Insert操作
  • 原文地址:https://www.cnblogs.com/chucklu/p/13164066.html
Copyright © 2011-2022 走看看