How to prevent users from logging in using the old/Copied session cookies. For example, I copy my session cookies and then logout from my website. If I import the old/copied session cookies in another browser and refresh the page, it shows me as authenticated user without login.

How to prevent/restrict this behavior? The issue is due to aspxauth cookie.

What are the additional checks that needs to be made?

Steps To Reproduce This Issue:

  1. Go to https://www.mysite.com/.

  2. Login to your account.

  3. Get the cookies using "EditThisCookie" extension

  4. Save the cookies, you copied in a text file.

  5. Logout from the account.

  6. Clear all the cookies related https://www.mysite.com/ from the browser

  7. Now Inject/Import Old Cookies to the https://www.mysite.com/ by "EditThisCookie"...

  8. You will be again logged In to https://www.mysite.com/ account.. using old session cookies.

  • Your question doesn`t related to sitecore. If you want to expire cookie on logout, you can use the same principles like "expire jwt token on logout". For example, you can add new field to membership database that you will use as a flag 1/0 that will notify you "user was logout, cookie is invalid", etc. – x3mxray May 17 '19 at 21:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.