Menu
I am being asked about cookie replay attacks with my ASP.NET websites forms authentication.
I have followed the advice below to protect against any attack but think that the site is still vulnerable if somebody manages to get at the cookie (albeit only for a short time). Is there a way to completely destroy the forms authentication session on logout so that even if someone had stolen the cookie there would be no chance of using it maliciously
Advice followed was
We believe we have taken all responsible steps we can to protect against this within the confines of ASP.NET. Please see detailed response below.
However we have implemented the recommended steps from Microsoft to defend against this (see http://support.microsoft.com/default.aspx?scid=kb;en-us;900111)
· The authentication cookie is never written to a client machine making it hard to steal.
· The application is run-able via SSL so a cookie is never issued over a non secure connection
· We enforce absolute expiration with a 15 minute timeout meaning that any issues cookie is useless after that time limit
· We use httpOnly cookies so that no-one can pro grammatically intercept or alter this cookie.
So even if the above precautions were broken, which we think highly unlikely, a malicious user would only have 15 minute window to break the precautions and successfully log in
415
A cookie replay attack occurs when an attacker steals a valid cookie of a user, and reuses it to impersonate that user to perform fraudulent or unauthorized transactions/activities.
The answer to preventing replay attacks is encrypting messages and including a key. IPsec provides anti-replay protection against attackers who could potentially intercept, duplicate or resend encrypted packets.
What about a replay attack within the same connection? In practice, messages sent over TLS usually include some counter or timestamp so that an attacker cannot record a TLS message and send it again within the same connection.
In a variation of this attack called a suppress-replay attack, an adversary might merely delay your message (by intercepting and later replaying it), so that it is received at a time when it is no longer appropriate.
A simple idea is to generate a random guid and store it in the user data section of the cookie. Then, when a user logs out, you retrieve the guid from the user data and write it in a server side repository with an annotation that this "session" has ended.
Then, have an http module that checks upon every request whether or not the guid from the userdata section of your cookie doesn't point to a ended session. If yes, terminate the request with a warning that expired cookie is reused.
This comes with a cost of an additional lookup per request.
142
Is there a way to completely destroy the forms authentication session on logout so that even if someone had stolen the cookie there would be no chance of using it maliciously
The way is to keep track on your server that the user is logged out and what time, so even if its going to see a page using a valid authenticated cookie, you double check if this user is also logged on your server records or not.
This means that you must have an extra table on your database to keep and check the login logout of your users status and not been 100% count on the authentication cookie.
Is there a way to completely destroy the forms authentication session on logout
In the worst scenario that the cookie is stolen, you actually can't.
Why is that, because the form authentication is actually keep on the cookie all the data (like when is expired, who user is, etc). So you can not delete that, is on the cookie, and the alternative is to synchronize that with your custom data on the server and have an extra level of security.
Related: Can some hacker steal the cookie from a user and login with that name on a web site?
24
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
