OpenID connect authentication with cookie authentication middleware [Asp.Net MVC ]

Question

In my ASP.NET MVC based application I am using 'OpenID connect authentication' middleware with 'cookie authentication middleware' (session/transient cookie).

While accessing the application I captured requests/responses using fiddler. I logged out of application. However I am able to successfully replay fiddler trace requests captured previously. Is this even a security concern? From the statement it looks obvious yes but when I think deeply, how is it different from capturing username/password in fiddler trace while accessing a bank application?

This behavior does not surprise me and is expected when I look at the way how the middleware pipeline is configured on the server. Basically the request goes to the OpenID middleware component first time when the cookie middleware component couldn't handle it because of a missing cookie, and that is where redirection to the identity provider happens and user is authenticated. After this authentication, the secured cookie between client browser and server only decides authenticity of user. So even though I logged out from the application, the request in fiddler trace still has a valid cookie with which the cookie middleware was able to successfully authenticate request.

The implementation pattern I described above seems to be a standard one, I would like to understand if the scenario I described has any security concerns?

Answer 1

When you use the cookie based authentication it means that your app base on stateless authentication, where stateless means you fully rely on data (cookie) that comes from user agent. In this case it is the most important thing to secure the cookie from stealing.

The case you present here is nothing else like Man-in-the-Middle attack, where you sniff the request and save the authentication cookie. If someone would stole the cookie in other way (like using the XSS or different technique) the result would be the same.

This is why so important is to use all possible security controls to mitigate cookie stealing.

Going back to your case, if you have logged out through browser, the authentication cookie have been invalidated by cookie middleware (overwritten and expired). If someone would send the same cookie (like you did) the only security control I can think of to mitigate this case (please remember about the stateless principle so nothing is stored on server side) is to parse the cookie and validate the expire timestamp (if included in cookie). If expiration time is short enough to be invalid in time of cookie replay, we can react to block the request. If not, we have a broken authentication.