As a result of a security audit, we must prevent an attacker from being able to do a cookie replay attack. Apparently this weakness has been around in the .NET framework for ages. There is also an old Microsoft Knowledge Base article on that subject.
In contrast to the workarounds mentioned in the MS KB, the blog post recommends to mitigate this weakness by implementing the following:
- When signing in, set a boolean session variable to
- When signing out, set the session variable to
- Check the session variable on each request. If the value is
false(or non-existing), return
Is this method sufficient to prevent a cookie replay attack? If it is, we would like to implement this in Sitecore in a way that developers don't have to think about it. Our idea is to override Sitecore's
- Override all three
Loginmethods and initialize the boolean session variable if login succeeded.
- Override the
Logoutmethod to set the session variable to
- Override the
GetActiveUsermethod and take action if the conditions are not met.
But how to override
GetActiveUser exactly? Do we return
Context.Domain.GetAnonymousUser() ?? Domain.GetDefaultAnonymousUser(), like the
AuthenticationHelper class does when there is no valid user?
Or is there a better way to transparently implement this in Sitecore?
- Website is only accessible with https
- Cookies are already flagged as
- On log out, we call
- Sitecore v7.2 rev 140314
- .NET 4.5