c# - Privilege Escalation & Session Hijacking in Identity MVC5 -

i using asp.net identity 2.0 authentication(owin middleware) in application. session hijacking: when login identity creates aspnet.applicationcookie.then,i copied aspnet.applicationcookie value.then logged out application.after logout,i creating cookie manually(aspnet.applicationcookie) , refresh redirects me home page.

privilege escalation: @ same time logged in user a.i copied(aspnet.applicationcookie) cookie , logged out.after logged in user b.i editing user b cookie , pasted user cookie , saved it.after refreshed browser can usera access , authentication.

i clearing session , and delete cookies when logged out.even asp.net identity(owin) generates new aspnet.applicationcookie each , every time.but still accepts old cookies , give me access.i don't know why? can 1 give me how invalidate old aspnet.applicationcookie after log out. code in startup.auth.cs

 public void configureauth(iappbuilder app)     {         // enable application use cookie store information signed in user         app.usecookieauthentication(new cookieauthenticationoptions         {             authenticationtype = defaultauthenticationtypes.applicationcookie,             loginpath = new pathstring("/account/login")         });         // use cookie temporarily store information user logging in third party login provider         app.useexternalsignincookie(defaultauthenticationtypes.externalcookie);       } 

//this logout code

    public actionresult logoff ( )     {         //delete cookies while user log out         string[] mycookies = request.cookies.allkeys;         foreach ( var cookies in mycookies )         {             response.cookies[ cookies ].expires = datetime.now.adddays(-1);          }         request.getowincontext( ).authentication.signout(microsoft.aspnet.identity.defaultauthenticationtypes.applicationcookie);          // authenticationmanager.signout( );         session.clear( );         session.removeall( );         session.abandon( );         return redirecttoaction("loginpage", "account");     } 

//this login controller code

 public async task<actionresult> login(loginviewmodel model, string returnurl)     {         if (modelstate.isvalid)         {             var user = await usermanager.findasync(model.username, model.password);             if (user != null)             {                 await signinasync(user, model.rememberme);                 return redirecttolocal(returnurl);             }             else             {                 modelstate.addmodelerror("", "invalid username or password.");             }         }          // if got far, failed, redisplay form         return view(model);     } 

this design. allowing signed-in multiple browsers , log-out in browser have clicked "log-out" , not other browsers.

but on log-out can update securitystamp on user, , set security stamp validation period low period of time.

this change security stamp:

await usermanager.updatesecuritystampasync(user.id); 

put in logout method.

and in startup.auth.cs modify usecookieauthentication in way:

app.usecookieauthentication(new cookieauthenticationoptions {     authenticationtype = defaultauthenticationtypes.applicationcookie,     loginpath = new pathstring("/account/login")     provider = new cookieauthenticationprovider     {         // enables application validate security stamp when user logs in.         // security feature used when change password or add external login account.           onvalidateidentity = securitystampvalidator.onvalidateidentity<applicationusermanager, applicationuser>(             validateinterval: timespan.fromminutes(1), // set low enough optimise between speed , db performance             regenerateidentity: (manager, user) => user.generateuseridentityasync(manager)),     } });             

the drawback approach - when logout procedure not executed - nothing happens. , when logout happens, logs out other sessions.