My company has a website that was recently the target of a security audit. They found that if a hacker had obtained the browser cookies used by our .NET website for authorization, that those cookies could be used to access the site even after the user they were created for had logged out by manually reinserted the cookies into their browser.

Does expiring a cookie change the cookie itself so that the .NET website knows it's expired, and if so, how does .NET (or a website in general) know that the un-expired cookie the hacker obtained is now expired.

  • 2
    It sounds like you're not properly expiring the cookies on the server when a user logs out. – AndrolGenhald Sep 28 '18 at 15:42
  • @AndrolGenhald I guess I'm mostly wondering if expiring the cookie itself has an affect on the previously acquired cookie? – dckuehn Sep 28 '18 at 15:44

How do sessions work?

Before you can understand the issue, you need to have an understanding of how sessions work.

The most common way to manage sessions is to send the browser a cookie with a random, unpredictable value when they log in, and map it to some data on the server:

  1. User POSTs login info
  2. Server validates login info, creates random string 2c64279f045bcb64ea8cd4d576514545, maps it to some data:

    2c64279f045bcb64ea8cd4d576514545: {userId: 123, username: "johndoe", otherdata: ...}

  3. Server tells browser to store 2c64279f045bcb64ea8cd4d576514545 as a cookie that will eventually expire

  4. The browser sends the cookie with every request to the server, so the server can see who is making the request

How does session expiration work?

Since the cookie data is used as a lookup value on the server, just expiring the cookie isn't enough. Anyone could copy the value and the server would have no idea that it should have expired. Session expiration must happen server side. How this is done depends on the language and framework you are using. I've not personally used .NET, but this may be relevant.

  • Thank you for your answer. I am reading more about the specific package we're using, an older version of Sustainsys and the author of the package says that if it's configured correctly I shouldn't need to call Session.Abandon() so I think our issue is in the configuration of that package. github.com/Sustainsys/Saml2/issues/836 – dckuehn Sep 28 '18 at 21:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.