0

We are using Sitecore 9.3. We have login and logout features in our site using Azure AD B2C.

During logout, we are performing below operations in that order -

  1. AuthenticationManager.Logout()
  2. We send request to Azure AD B2C to logout and send a post logout redirect url
  3. Delete the cookie - .AspNet.Cookie
  4. Calling HttpContext.Current.Session.Abandon()
  5. Calling HttpContext.Current.Session.Clear()
  6. Calling Request.GetOwinContext().Authentication.SignOut()

In the penetration test done on the site, it was found that even after logging out, calling - https://portalname/sitecore/api/ssc/item/{item_id}/children

with .ASPNet.Cookies in the header is giving 200 OK response.

Can anyone please suggest why is application still accepting the value of .AspNet.Cookies cookie? How to prevent this behavior?

1 Answer 1

0

You need to send a sign-out request to Azure AD B2C because you are "only" logging out user from Sitecore. Upon a sign-out request, Azure AD B2C invalidates the Azure AD B2C cookie-based session, and attempts to sign out from federated identity providers.

You can do it by sending GET request to this url:

https://{tenant}.b2clogin.com/{tenant}.onmicrosoft.com/{policy}/oauth2/v2.0/logout?post_logout_redirect_uri=https%3A%2F%2Fjwt.ms%2F

enter image description here

You can find more information here -> https://learn.microsoft.com/en-us/azure/active-directory-b2c/openid-connect#send-a-sign-out-request

1
  • Hi, Thank you for your answer. This we are doing already in the Step 2 of logout.
    – NewbieHere
    Commented Aug 1, 2023 at 6:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.