3

I have been banging my head against the wall and searching the web for this but I think I am having issues understanding the whole process of logging users out of an asp.net webforms application. The issue: I am able to log in to my application and it uses cookies, so I have my cookie set in the browser. here is the config forms authentication section,

<forms loginUrl="login.aspx" timeout="15" protection="All" name="Domain.MYDOMAIN" path="/" domain="mysite.local" cookieless="UseDeviceProfile"/>

here is the front end control 

<li><asp:LoginStatus ID="LoginStatus1" runat="server" OnLoggedOut="OnLoggedOut" /></li>

In the OnLoggedOut Method we do something like this.

protected void OnLoggedOut(object sender, EventArgs e)
{
    FormsAuthentication.SignOut();
     /* Abandon session object to destroy all session variables */
    HttpContext.Current.Session.Clear();
    HttpContext.Current.Session.Abandon();
    Response.Redirect("~/login.aspx");
}

This will clear the cookies from the browser. But if before I do this I copy the cookie name pair value of Domain.MYDOMAIN = "what ever it would be"

and add that to a postman call, it is still showing me as logged in! Very frustrating. when I am logged in enter image description here

I log out using the logout button mentioned above and the cookie is removed enter image description here

Then I take that cookie to Postman and make the call to the landing / default page and it is showing me as logged in still!!!
enter image description here

I have been reading that the cookie is related to a "ticket" but I am not sure how to expire that ticket on the server side. Once the user clicks logout I dont want this cookie value to be used again to reach a page, any page within the application. Any help would be appreciated! Thank You!

Side Note: I have my session state set to InProc

 <sessionState mode="InProc" />
AtLeastTheresToast
  • 327
  • 6
  • 18
  • Set your cookie Expires to DateTime.Now.AddDays(-1d); – Edney Holder Jan 03 '20 at 18:37
  • @EdneyHolder Is the same as delete the cookie - the cookie that authenticate the user is exist, if you add expires, the previews authenticated cookie is still exist and can be taken by some hacker theoretically – Aristos Jan 03 '20 at 18:44
  • I set the expired cookie but it still didn't seem to help. I am going to go with Aristos' answer and perform the double-check. Thank you for your support. – AtLeastTheresToast Jan 03 '20 at 19:51

1 Answers1

2

Ones the user is authenticate with user name and password, then we set a cookie that have a time out and this cookie let him login.

Even if you delete the cookie from one browser, if you still have it and place it again – you permit to login again because the cookie is gives the “OK” to do that.

This is not only on asp.net but everywhere (Microsoft, google, Facebook).

To add an extra layer of security, and avoid to someone steal the cookie:

  • First step is to force only the SSL for the cookies (*). <httpCookies httpOnlyCookies="true" requireSSL="true" />. Using that you make it difficult to impossible to steal the cookie

  • Second step is on logout to save that cookie on a database, then on every request check if the cookies have been logged out Third step is to also check if the cookie come from the same browser id.

So, you connect the cookie with the browser data, and with a flag that the user press the logout.

You make that checks on global.asax

protected void Application_BeginRequest(Object sender, EventArgs e)

(*) The first step : Can some hacker steal a web browser cookie from a user and login with that name on a web site?

The difficult way is to add the database extra layer of protection and connect the cookie with other user information's as I say, the browser id, and a flag if have been logged out. The main idea is to keep on server the authenticated cookie that you have set and double check it - now you don't do that.

Aristos
  • 66,005
  • 16
  • 114
  • 150
  • You are correct, I need to do the double-check. Which is not ideal... I feel like there should be an easier way to do this with ASP.NET. Thanks for the help. – AtLeastTheresToast Jan 03 '20 at 19:50
  • 1
    @AtLeastTheresToast at out of the box solution is not so easy to give it on asp.net because you need a database to store all of that. – Aristos Jan 04 '20 at 19:03
  • yea, I am figuring that out slowly. have it working locally now struggling with the stage servers. Lame. – AtLeastTheresToast Jan 06 '20 at 16:22