In my ASP.NET MVC based application I am using 'OpenID connect authentication' middleware with 'cookie authentication middleware' (session/transient cookie).

While accessing the application I captured requests/responses using fiddler. I logged out of application. However I am able to successfully replay fiddler trace requests captured previously. Is this even a security concern? From the statement it looks obvious yes but when I think deeply, how is it different from capturing username/password in fiddler trace while accessing a bank application?

This behavior does not surprise me and is expected when I look at the way how the middleware pipeline is configured on the server. Basically the request goes to the OpenID middleware component first time when the cookie middleware component couldn't handle it because of a missing cookie, and that is where redirection to the identity provider happens and user is authenticated. After this authentication, the secured cookie between client browser and server only decides authenticity of user. So even though I logged out from the application, the request in fiddler trace still has a valid cookie with which the cookie middleware was able to successfully authenticate request.

The implementation pattern I described above seems to be a standard one, I would like to understand if the scenario I described has any security concerns?

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.