Search code examples
c#asp.netauthenticationwebformssession-cookies

ASP.NET WebForms Authentication Logout, Cookie can still be used to access site

I have been banging my head against the wall and searching the web for this but I think I am having issues understanding the whole process of logging users out of an asp.net webforms application. The issue: I am able to log in to my application and it uses cookies, so I have my cookie set in the browser. here is the config forms authentication section,

<forms loginUrl="login.aspx" timeout="15" protection="All" name="Domain.MYDOMAIN" path="/" domain="mysite.local" cookieless="UseDeviceProfile"/>

here is the front end control 

<li><asp:LoginStatus ID="LoginStatus1" runat="server" OnLoggedOut="OnLoggedOut" /></li>

In the OnLoggedOut Method we do something like this.

protected void OnLoggedOut(object sender, EventArgs e)
{
    FormsAuthentication.SignOut();
     /* Abandon session object to destroy all session variables */
    HttpContext.Current.Session.Clear();
    HttpContext.Current.Session.Abandon();
    Response.Redirect("~/login.aspx");
}

This will clear the cookies from the browser. But if before I do this I copy the cookie name pair value of Domain.MYDOMAIN = "what ever it would be"

and add that to a postman call, it is still showing me as logged in! Very frustrating. when I am logged in enter image description here

I log out using the logout button mentioned above and the cookie is removed enter image description here

Then I take that cookie to Postman and make the call to the landing / default page and it is showing me as logged in still!!!
enter image description here

I have been reading that the cookie is related to a "ticket" but I am not sure how to expire that ticket on the server side. Once the user clicks logout I dont want this cookie value to be used again to reach a page, any page within the application. Any help would be appreciated! Thank You!

Side Note: I have my session state set to InProc

 <sessionState mode="InProc" />
Solution

  • Ones the user is authenticate with user name and password, then we set a cookie that have a time out and this cookie let him login.

    Even if you delete the cookie from one browser, if you still have it and place it again – you permit to login again because the cookie is gives the “OK” to do that.

    This is not only on asp.net but everywhere (Microsoft, google, Facebook).

    To add an extra layer of security, and avoid to someone steal the cookie:

    • First step is to force only the SSL for the cookies (*). <httpCookies httpOnlyCookies="true" requireSSL="true" />. Using that you make it difficult to impossible to steal the cookie

    • Second step is on logout to save that cookie on a database, then on every request check if the cookies have been logged out Third step is to also check if the cookie come from the same browser id.

    So, you connect the cookie with the browser data, and with a flag that the user press the logout.

    You make that checks on global.asax

    protected void Application_BeginRequest(Object sender, EventArgs e)

    (*) The first step : Can some hacker steal a web browser cookie from a user and login with that name on a web site?

    The difficult way is to add the database extra layer of protection and connect the cookie with other user information's as I say, the browser id, and a flag if have been logged out. The main idea is to keep on server the authenticated cookie that you have set and double check it - now you don't do that.