I could be wrong, but I would think that the Response.Redirect would not send
the updated cookie along with it - I think cookies can only be set if you're
returning a normal response (200) rather than a redirect(302?). Could you not,
instead, place the code to expire the old authentication into the Page_Load of
the login.aspx page?
David Knapman
Analyst Programmer
Consumer Credit Counselling Service
Tel: 0113 2355339
-----Original Message-----
From: spawn security [mailto:spawn.security@gmail.com]
Sent: 16 August 2005 18:08
To: webappsec@securityfocus.com
Subject: Cookie not expiring...
I'm testing an application and after clicking on the logout button
the session management cookie does not expire. More specifically, the
application is using the FormsAuthentication class signout method to
"logout" an authenticated user.
Private Sub cmdSignOut_ServerClick(ByVal sender As System.Object,
ByVal e As System.EventArgs) _
Handles cmdSignOut.ServerClick
FormsAuthentication.SignOut()
Session.Abandon()
Response.Redirect("login.aspx", True)
End Sub
According to Microsoft documentation, this
FormsAuthentication.SignOut method works by returning a Set-Cookie
header to the browser that sets the cookie's value to a null string
and sets the cookie's expiration date to a date in the past. This is
only expiring the cookie on the client/browser side. Which will allow
a "malicious" user, who had access to the cookie, to reuse it after
user logs out.
Does anyone know how to force the cookie to expire on the
server side ?
Thanks.
VISIT OUR WEBSITE AT http://www.cccs.co.uk
---------------------------------------------------------------------
This email message is intended for the individual to whom itâs addressed
and may contain information that is privileged and confidential. If you are
not the intended recipient, you are hereby notified that any use or
dissemination
of this communication is strictly prohibited. If you have received this
information
in error, please return it to us immediately and delete it from your computer.
The contents or opinions expressed within this email are not intended to
represent the views of CCCS unless specifically stated to be so.
This email is not guaranteed to be free from any computer viruses, although
it has been checked using the Trend Virus Suite. You should check this email
and any attachments for the presence of viruses before downloading any files.
