How to reset authorization token in asp.net after email changing?

Question

I have asp net web application. It use asp net identity 2. If i change my email, my webapi token stay valid. How i can reset token? Sorry for my bad language.

Ok, I issue a token as follows: 1) User call webapi method (get request for {{host}}/token. Method find this user from usercontext (username,password) in user repositories. if user found, system generate token.

var tokenExpiration = TimeSpan.FromDays(1); 
var ticket = accountManager.generateTicket(user.UserName, tokenExpiration);
if (ticket != null){
var token = Startup.OAuthOptions.AccessTokenFormat.Protect(ticket);
return new TokenResponse{
Token = token,
TokenExpires = tokenExpiration.TotalSeconds
};
}

Code for "generateTicket":

ClaimsIdentity identity = new ClaimsIdentity(OAuthDefaults.AuthenticationType);

            identity.AddClaim(new Claim(ClaimTypes.Name, userName));

            var props = new AuthenticationProperties()
            {
                IssuedUtc = DateTime.UtcNow,
                ExpiresUtc = DateTime.UtcNow.Add(tokenExpiration),
            };

            return new AuthenticationTicket(identity, props);

post some code which shows what have you tried till now. You issue seems interesting — It's a trap, Apr 06 '17 at 12:22
Unfortunately, until now i have not found methods for reset the token. The token is issued for the mobile application. It is issued for the authorization of a particular user, that he could use webapi. If user has change his email, toke stay valid. User can still use webapi. I thought that if you call method SignOut(), then not only the cookies but also the token are reset. — QuaternioNoir, Apr 06 '17 at 12:46
The solution will lie in how are you issuing and validating the token. That's y i asked you to post that code — It's a trap, Apr 06 '17 at 12:47
I'm try to delete claim (identity.DeleteClaim()), but this not work for me. — QuaternioNoir, Apr 06 '17 at 12:56
I don't know. I added [authorize] prefix before API methods. — QuaternioNoir, Apr 06 '17 at 13:28

score 0 · Answer 1 · answered Nov 01 '17 at 09:22

The right way to invalidate a token is to add claim with a value from user's DB record which will be changed after a certain event (like email change), then on a new request to the API, the token's claim value must be checked that match with user's current DB record. There is a thing called SecurityStamp which is part of Asp.Net identity which does just that. You can read more about it here.

To enable the automatic SecurityStamp claim in token issuing process you need to define your user IUserSecurityStampStore:

public class MyUserStore : IUserSecurityStampStore<ApplicationUser>
{
   // some code
}

there is an example here.

In the end, you need to check on the right place the current token SecurityStamp claim with user's DB security stamp. Here is a sample of WebAPI authorization attribute:

    public class CustomAuthorizeAttribute : AuthorizeAttribute
    {
        protected override bool IsAuthorized(HttpActionContext actionContext)
        {
            var user = actionContext.RequestContext.Principal.Identity;
            if (!user.IsAuthenticated)
            {
                return false;
            }


            var principals = actionContext.RequestContext.Principal.Identity as ClaimsIdentity;
            if (!authorizationValidator.SecurityStampMatch(GetClaimValue(principals, "AspNet.Identity.SecurityStamp"), user.GetGuidUserId()))
            {
                return false;
            }

            return true;
        }

        private string GetClaimValue(ClaimsIdentity principals, string claimType)
        {
            var claim = principals.Claims.FirstOrDefault(c => c.Type.Equals(claimType));
            return claim?.Value;
        }
    }
}

Just to point for extra clearance the change email, confirm phone number, change password thigger Asp.Net Identity to regenerate the Security Stamp so you don't have to worry about that.

Edit:

the authorizationValidator has this code in SecurityStampMatch:

public bool SecurityStampMatch(string securityStampClaim, Guid userId)
{
    if (String.IsNullOrEmpty(securityStampClaim))
    {
        return false;
    }

    var usersSecurityStamp = _userManager.GetSecurityStamp(userId);
    return securityStampClaim.Equals(usersSecurityStamp);
}

How to reset authorization token in asp.net after email changing?

1 Answers1