Adding a SessionStore (ITicketStore) to my application cookie makes my Data Protection Provider fail to work

Question

tl;dr

• Have .NET Core 2.0 application which uses a Data Protection Provider which persists a key file across all of the sites on my domain.
• Worked fine, however, application cookie became too big.
• Implemented a SessionStore on the cookie using ITicketStore
• Cookie size is greatly reduced, however, the key from the DPP no longer persists across my sites.

Is there something I'm supposed to do in my ITicketStore implementation to fix this? I'm assuming so, since this is where the problem arises, however, I could not figure it out.

Some snippets:

---

Startup.cs --> ConfigureServices()

var keysFolder = $@"c:\temp\_WebAppKeys\{_env.EnvironmentName.ToLower()}";
var protectionProvider = DataProtectionProvider.Create(new DirectoryInfo(keysFolder));
var dataProtector = protectionProvider.CreateProtector(
            "Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationMiddleware",
            "Cookies",
            "v2");

--snip--

services.AddSingleton<ITicketStore, TicketStore>();

--snip--

services.AddDataProtection()
    .PersistKeysToFileSystem(new DirectoryInfo(keysFolder))
    .SetApplicationName("app_auth");

services.ConfigureApplicationCookie(options =>
{
    options.Cookie.Name = ".XAUTH";
    options.Cookie.Domain = ".domain.com";
    options.ExpireTimeSpan = TimeSpan.FromDays(7);
    options.LoginPath = "/Account/Login";
    options.DataProtectionProvider = protectionProvider;
    options.TicketDataFormat = new TicketDataFormat(dataProtector);
    options.CookieManager = new ChunkingCookieManager();
    options.SessionStore = services.BuildServiceProvider().GetService<ITicketStore>();
});

---

TicketStore.cs

public class TicketStore : ITicketStore
{
    private IMemoryCache _cache;
    private const string KeyPrefix = "AuthSessionStore-";

public TicketStore(IMemoryCache cache)
{
    _cache = cache;
}

public Task RemoveAsync(string key)
{
    _cache.Remove(key);
    return Task.FromResult(0);
}

public Task RenewAsync(string key, AuthenticationTicket ticket)
{
    var options = new MemoryCacheEntryOptions
    {
        Priority = CacheItemPriority.NeverRemove
    };
    var expiresUtc = ticket.Properties.ExpiresUtc;

    if (expiresUtc.HasValue)
    {
        options.SetAbsoluteExpiration(expiresUtc.Value);
    }

    options.SetSlidingExpiration(TimeSpan.FromMinutes(60));

    _cache.Set(key, ticket, options);

    return Task.FromResult(0);
}

public Task<AuthenticationTicket> RetrieveAsync(string key)
{
    AuthenticationTicket ticket;
    _cache.TryGetValue(key, out ticket);
    return Task.FromResult(ticket);
}

public async Task<string> StoreAsync(AuthenticationTicket ticket)
{
    var key = KeyPrefix + Guid.NewGuid();
    await RenewAsync(key, ticket);
    return key;
}

Solution 1

I also ran into this issue.

The SessionIdClaim value in Microsoft.Owin.Security.Cookies is "Microsoft.Owin.Security.Cookies-SessionId", while the SessionIdClaim value in Microsoft.AspNetCore.Authentication.Cookies is "Microsoft.AspNetCore.Authentication.Cookies-SessionId".

This results in a SessionId Missing error due to this code on the AspNetCore side even when you implemented a distributed session store (using RedisCacheTicketStore for example) as decribed here: https://mikerussellnz.github.io/.NET-Core-Auth-Ticket-Redis/

I was able to re-compile the AspNetKatana project with the new string, and then the SessionID was found on the .NET Core side.

Additionally, it seems the AuthenticationTicket classes are different, so I was able to get this working by implementing a conversion method to convert the Microsoft.Owin.Security.AuthenticationTicket Ticket to the Microsoft.AspNetCore.Authentication.AuthenticationTicket Ticket and then store the ticket using the AspNetCore serializer (Microsoft.AspNetCore.Authentication.TicketSerializer).

public Microsoft.AspNetCore.Authentication.AuthenticationTicket ConvertTicket(Microsoft.Owin.Security.AuthenticationTicket ticket)
{
    Microsoft.AspNetCore.Authentication.AuthenticationProperties netCoreAuthProps = new Microsoft.AspNetCore.Authentication.AuthenticationProperties();
    netCoreAuthProps.IssuedUtc = ticket.Properties.IssuedUtc;
    netCoreAuthProps.ExpiresUtc = ticket.Properties.ExpiresUtc;
    netCoreAuthProps.IsPersistent = ticket.Properties.IsPersistent;
    netCoreAuthProps.AllowRefresh = ticket.Properties.AllowRefresh;
    netCoreAuthProps.RedirectUri = ticket.Properties.RedirectUri;

    ClaimsPrincipal cp = new ClaimsPrincipal(ticket.Identity);

    Microsoft.AspNetCore.Authentication.AuthenticationTicket netCoreTicket = new Microsoft.AspNetCore.Authentication.AuthenticationTicket(cp, netCoreAuthProps, "Cookies");

    return netCoreTicket;
}   
private static Microsoft.AspNetCore.Authentication.TicketSerializer _netCoreSerializer = Microsoft.AspNetCore.Authentication.TicketSerializer.Default;

private static byte[] SerializeToBytesNetCore(Microsoft.AspNetCore.Authentication.AuthenticationTicket source)
{
    return _netCoreSerializer.Serialize(source);
}

With these additional methods, the RenwAsync method can be changed to this:

      public Task RenewAsync(string key, Microsoft.Owin.Security.AuthenticationTicket ticket)
        {
            var options = new DistributedCacheEntryOptions();
            var expiresUtc = ticket.Properties.ExpiresUtc;
            if (expiresUtc.HasValue)
            {
                options.SetAbsoluteExpiration(expiresUtc.Value);
            }

            var netCoreTicket = ConvertTicket(ticket);                      
// convert to .NET Core format     
            byte[] netCoreVal = SerializeToBytesNetCore(netCoreTicket);     
// serialize ticket using .NET Core Serializer
            _cache.Set(key, netCoreVal, options);


            return Task.FromResult(0);
        }

I am not sure if this is the best approach, but it seems to work on my test project, admittedly I am not using this in production, hopefully this helps.

UPDATE #1: Alternate approach to avoid re-compiling

It looks like this might also work by re-creating the cookie with both SessionId claim values on the OWIN side. This will allow you to use the standard library without re-compiling. I tried it this morning but have not had a chance to thoroughly test it, although on my initial test it does load the claims properly on both sides. Basically, if you modify the authentication ticket to have both SessionId claims, it will find the session in both applications. This code snippet gets the cookie, unprotects it, adds the additional claim, and then replaces the cookie inside the OnValidateIdentity event of the CookieAuthenticationProvider.

string cookieName = "myappname";
string KatanaSessionIdClaim = "Microsoft.Owin.Security.Cookies-SessionId";
string NetCoreSessionIdClaim = "Microsoft.AspNetCore.Authentication.Cookies-SessionId";

Microsoft.Owin.Security.Interop.ChunkingCookieManager cookieMgr = new ChunkingCookieManager();

OnValidateIdentity = ctx =>
{
    var incomingIdentity = ctx.Identity;
    var cookie = cookieMgr.GetRequestCookie(ctx.OwinContext, cookieName);
    if (cookie != null)
    {
        var ticket = TicketDataFormat.Unprotect(cookie);
        if (ticket != null)
        {
            Claim claim = ticket.Identity.Claims.FirstOrDefault(c => c.Type.Equals(KatanaSessionIdClaim));
            Claim netCoreSessionClaim = ticket.Identity.Claims.FirstOrDefault(c => c.Type.Equals(NetCoreSessionIdClaim));
            if (netCoreSessionClaim == null)
            {
                // adjust cookie options as needed.
                CookieOptions opts = new CookieOptions();
                opts.Expires = ticket.Properties.ExpiresUtc == null ? 
    DateTime.Now.AddDays(14) : ticket.Properties.ExpiresUtc.Value.DateTime;
                opts.HttpOnly = true;
                opts.Path = "/";
                opts.Secure = true;

                netCoreSessionClaim = new Claim(NetCoreSessionIdClaim, claim.Value);
                ticket.Identity.AddClaim(netCoreSessionClaim);
                string newCookieValue = TicketDataFormat.Protect(ticket);
                cookieMgr.DeleteCookie(ctx.OwinContext, cookieName, opts);
                cookieMgr.AppendResponseCookie(ctx.OwinContext, cookieName, newCookieValue, opts);
            }
        }
    }
}

If there is a better approach I would be curious to know, or a better place to swap out the cookie.

Solution 2

The problem is, as other answers have pointed out, that the Owin cookie's session key claim has another type string than the one expected in ASP.Net Core.

The following implementation of a ticket data format makes sure to add the session key claim for ASP.Net Core when generating the cookie string.

public class AspNetCoreCompatibleTicketDataFormat : ISecureDataFormat<AuthenticationTicket> {

    private const string OwinSessionIdClaim = "Microsoft.Owin.Security.Cookies-SessionId";
    private const string AspNetCoreSessionIdClaim = "Microsoft.AspNetCore.Authentication.Cookies-SessionId";

    private readonly ISecureDataFormat<AuthenticationTicket> dataFormat;

    public AspNetCoreCompatibleTicketDataFormat(IDataProtector protector) {
        this.dataFormat = new AspNetTicketDataFormat(protector);
    }

    public string Protect(AuthenticationTicket data) {
        var sessionClaim = data.Identity.FindFirst(OwinSessionIdClaim);
        if (sessionClaim != null) {
            data.Identity.AddClaim(new Claim(AspNetCoreSessionIdClaim, sessionClaim.Value));
        }
        return this.dataFormat.Protect(data);
    }

    public AuthenticationTicket Unprotect(string protectedText) {
        return this.dataFormat.Unprotect(protectedText);
    }
}

This code should be added to the ASP.Net Framework project. You use it instead of the AspNetTicketDataFormat in your StartUp.cs code, like this:

app.UseCookieAuthentication(new CookieAuthenticationOptions {
    TicketDataFormat = new AspNetCoreCompatibleTicketDataFormat(
        new DataProtectorShim(...

The code makes sure that the generated cookie contains a session id claim known to ASP.NET Core. It works for the scenario where you generate the cookie in an ASP.NET Framework OWIN project and consume it in an ASP.NET Core project.

One would have to make sure to always add both to get it working in the opposite circumstance where the cookie is generated in the ASP.NET Core project.

Solution 3

I ended up doing a mix of the above answers, Replacing the ICookieManager implementation on the AspNetCore side that generates the cookies, adding both claims when doing so (as per the relevant part of the answer given by @AnthonyValeri):

public class OwinAspNetCompatibleCookieManager : ICookieManager
{
    private const string OwinSessionIdClaim = "Microsoft.Owin.Security.Cookies-SessionId";
    private const string AspNetCoreSessionIdClaim = "Microsoft.AspNetCore.Authentication.Cookies-SessionId";

    private readonly ICookieManager actualCookieManager;

    public OwinAspNetCompatibleCookieManager(ICookieManager actualCookieManager) => this.actualCookieManager = actualCookieManager;

    // TODO oh this async void is so so bad, i have to find another way
    public async void AppendResponseCookie(HttpContext context, string key, string value, CookieOptions options)
    {
        IAuthenticationHandler handler = await context.RequestServices.GetRequiredService<IAuthenticationHandlerProvider>().GetHandlerAsync(context, CookieAuthenticationDefaults.AuthenticationScheme).ConfigureAwait(false);

        if (handler is CookieAuthenticationHandler cookieHandler)
        {
            value = MakeOwinAspNetCoreCompatible(key, value, cookieHandler.Options);
        }

        actualCookieManager.AppendResponseCookie(context, key, value, options);
    }

    public void DeleteCookie(HttpContext context, string key, CookieOptions options)
    {
        actualCookieManager.DeleteCookie(context, key, options);
    }

    public string GetRequestCookie(HttpContext context, string key)
    {
        return actualCookieManager.GetRequestCookie(context, key);
    }

    private string MakeOwinAspNetCoreCompatible(string key, string cookieValue, CookieAuthenticationOptions options)
    {
        if (key.Equals("MySharedCookieName") && !string.IsNullOrWhiteSpace(cookieValue))
        {
            AuthenticationTicket ticket = options.TicketDataFormat.Unprotect(cookieValue);

            ClaimsPrincipal principal = ticket.Principal;
            Claim aspNetCoreClaim = ticket.Principal.Claims.FirstOrDefault(x => x.Type.Equals(AspNetCoreSessionIdClaim));
            Claim owinClaim = ticket.Principal.Claims.FirstOrDefault(x => x.Type.Equals(OwinSessionIdClaim));
            Claim[] claims = null;

            if (aspNetCoreClaim != null && owinClaim == null)
            {
                claims = new Claim[] { aspNetCoreClaim, new Claim(OwinSessionIdClaim, aspNetCoreClaim.Value) };
            }
            else if (aspNetCoreClaim == null && owinClaim != null)
            {
                claims = new Claim[] { owinClaim, new Claim(AspNetCoreSessionIdClaim, owinClaim.Value) };
            }

            if (claims?.Length > 0)
            {
                var newIdentity = new ClaimsIdentity(claims, principal.Identity.AuthenticationType);
                principal = new ClaimsPrincipal(newIdentity);
                ticket = new AuthenticationTicket(principal, ticket.AuthenticationScheme);
                cookieValue = options.TicketDataFormat.Protect(ticket);
            }
        }

        return cookieValue;
    }
}

And then configuring it on the .AddCookie() call in ConfigureServices:

...
options.CookieManager = new OwinAspNetCompatibleCookieManager(new ChunkingCookieManager());
...

Solution 4

I ran into the same issue and banging my head to resolve this. But thanks to @Anthony Valeri to pointing right at where the issue is. So I came up with the solution below. (I was doing this as part of POC for one of our migration projects and this is not been tested in Production, but worked for POC.)

1. Created an extended CookieAuthenticationOptions class and added a new property.

public class ExtendedCookieAuthenticationOptions : CookieAuthenticationOptions
{
    public string SessionIdClaim { get; set; }
}

2. Copied CookieAuthenticationHandler class from GitHub Source Code and extended that with above class

public class ExtendedCookieAuthenticationHandler : SignInAuthenticationHandler<ExtendedCookieAuthenticationOptions>
{
    private const string HeaderValueNoCache = "no-cache";
    private const string HeaderValueEpocDate = "Thu, 01 Jan 1970 00:00:00 GMT";
    private const string SessionIdClaim = "Microsoft.AspNetCore.Authentication.Cookies-SessionId";

    private bool _shouldRefresh;
    private bool _signInCalled;
    private bool _signOutCalled;

    private DateTimeOffset? _refreshIssuedUtc;
    private DateTimeOffset? _refreshExpiresUtc;
    private string _sessionKey;
    private Task<AuthenticateResult> _readCookieTask;
    private AuthenticationTicket _refreshTicket;

    public ExtendedCookieAuthenticationHandler(IOptionsMonitor<ExtendedCookieAuthenticationOptions> options, ILoggerFactory logger, UrlEncoder encoder, ISystemClock clock)
        : base(options, logger, encoder, clock)
    {
    }

    /// <summary>
    /// Added this to overwrite default SessionIdClaim value
    /// </summary>
    public virtual string SessionIdClaimType
    {
        get { return string.IsNullOrEmpty(Options.SessionIdClaim) ? SessionIdClaim : Options.SessionIdClaim; }
    }
    /// <summary>
    /// The handler calls methods on the events which give the application control at certain points where processing is occurring.
    /// If it is not provided a default instance is supplied which does nothing when the methods are called.
    /// </summary>
    protected new CookieAuthenticationEvents Events
    {
        get { return (CookieAuthenticationEvents)base.Events; }
        set { base.Events = value; }
    }

    protected override Task InitializeHandlerAsync()
    {
        // Cookies needs to finish the response
        Context.Response.OnStarting(FinishResponseAsync);
        return Task.CompletedTask;
    }

    /// <summary>
    /// Creates a new instance of the events instance.
    /// </summary>
    /// <returns>A new instance of the events instance.</returns>
    protected override Task<object> CreateEventsAsync() => Task.FromResult<object>(new CookieAuthenticationEvents());

    private Task<AuthenticateResult> EnsureCookieTicket()
    {
        // We only need to read the ticket once
        if (_readCookieTask == null)
        {
            _readCookieTask = ReadCookieTicket();
        }
        return _readCookieTask;
    }

    private void CheckForRefresh(AuthenticationTicket ticket)
    {
        var currentUtc = Clock.UtcNow;
        var issuedUtc = ticket.Properties.IssuedUtc;
        var expiresUtc = ticket.Properties.ExpiresUtc;
        var allowRefresh = ticket.Properties.AllowRefresh ?? true;
        if (issuedUtc != null && expiresUtc != null && Options.SlidingExpiration && allowRefresh)
        {
            var timeElapsed = currentUtc.Subtract(issuedUtc.Value);
            var timeRemaining = expiresUtc.Value.Subtract(currentUtc);

            if (timeRemaining < timeElapsed)
            {
                RequestRefresh(ticket);
            }
        }
    }

    private void RequestRefresh(AuthenticationTicket ticket, ClaimsPrincipal replacedPrincipal = null)
    {
        var issuedUtc = ticket.Properties.IssuedUtc;
        var expiresUtc = ticket.Properties.ExpiresUtc;

        if (issuedUtc != null && expiresUtc != null)
        {
            _shouldRefresh = true;
            var currentUtc = Clock.UtcNow;
            _refreshIssuedUtc = currentUtc;
            var timeSpan = expiresUtc.Value.Subtract(issuedUtc.Value);
            _refreshExpiresUtc = currentUtc.Add(timeSpan);
            _refreshTicket = CloneTicket(ticket, replacedPrincipal);
        }
    }

    private AuthenticationTicket CloneTicket(AuthenticationTicket ticket, ClaimsPrincipal replacedPrincipal)
    {
        var principal = replacedPrincipal ?? ticket.Principal;
        var newPrincipal = new ClaimsPrincipal();
        foreach (var identity in principal.Identities)
        {
            newPrincipal.AddIdentity(identity.Clone());
        }

        var newProperties = new AuthenticationProperties();
        foreach (var item in ticket.Properties.Items)
        {
            newProperties.Items[item.Key] = item.Value;
        }

        return new AuthenticationTicket(newPrincipal, newProperties, ticket.AuthenticationScheme);
    }

    private async Task<AuthenticateResult> ReadCookieTicket()
    {
        var cookie = Options.CookieManager.GetRequestCookie(Context, Options.Cookie.Name);
        if (string.IsNullOrEmpty(cookie))
        {
            return AuthenticateResult.NoResult();
        }

        var ticket = Options.TicketDataFormat.Unprotect(cookie, GetTlsTokenBinding());
        if (ticket == null)
        {
            return AuthenticateResult.Fail("Unprotect ticket failed");
        }

        if (Options.SessionStore != null)
        {
            var claim = ticket.Principal.Claims.FirstOrDefault(c => c.Type.Equals(SessionIdClaimType));
            if (claim == null)
            {
                return AuthenticateResult.Fail("SessionId missing");
            }
            _sessionKey = claim.Value;
            ticket = await Options.SessionStore.RetrieveAsync(_sessionKey);
            if (ticket == null)
            {
                return AuthenticateResult.Fail("Identity missing in session store");
            }
        }

        var currentUtc = Clock.UtcNow;
        var expiresUtc = ticket.Properties.ExpiresUtc;

        if (expiresUtc != null && expiresUtc.Value < currentUtc)
        {
            if (Options.SessionStore != null)
            {
                await Options.SessionStore.RemoveAsync(_sessionKey);
            }
            return AuthenticateResult.Fail("Ticket expired");
        }

        CheckForRefresh(ticket);

        // Finally we have a valid ticket
        return AuthenticateResult.Success(ticket);
    }

    protected override async Task<AuthenticateResult> HandleAuthenticateAsync()
    {
        var result = await EnsureCookieTicket();
        if (!result.Succeeded)
        {
            return result;
        }

        var context = new CookieValidatePrincipalContext(Context, Scheme, Options, result.Ticket);
        await Events.ValidatePrincipal(context);

        if (context.Principal == null)
        {
            return AuthenticateResult.Fail("No principal.");
        }

        if (context.ShouldRenew)
        {
            RequestRefresh(result.Ticket, context.Principal);
        }

        return AuthenticateResult.Success(new AuthenticationTicket(context.Principal, context.Properties, Scheme.Name));
    }

    private CookieOptions BuildCookieOptions()
    {
        var cookieOptions = Options.Cookie.Build(Context);
        // ignore the 'Expires' value as this will be computed elsewhere
        cookieOptions.Expires = null;

        return cookieOptions;
    }

    protected virtual async Task FinishResponseAsync()
    {
        // Only renew if requested, and neither sign in or sign out was called
        if (!_shouldRefresh || _signInCalled || _signOutCalled)
        {
            return;
        }

        var ticket = _refreshTicket;
        if (ticket != null)
        {
            var properties = ticket.Properties;

            if (_refreshIssuedUtc.HasValue)
            {
                properties.IssuedUtc = _refreshIssuedUtc;
            }

            if (_refreshExpiresUtc.HasValue)
            {
                properties.ExpiresUtc = _refreshExpiresUtc;
            }

            if (Options.SessionStore != null && _sessionKey != null)
            {
                await Options.SessionStore.RenewAsync(_sessionKey, ticket);
                var principal = new ClaimsPrincipal(
                    new ClaimsIdentity(
                        new[] { new Claim(SessionIdClaimType, _sessionKey, ClaimValueTypes.String, Options.ClaimsIssuer) },
                        Scheme.Name));
                ticket = new AuthenticationTicket(principal, null, Scheme.Name);
            }

            var cookieValue = Options.TicketDataFormat.Protect(ticket, GetTlsTokenBinding());

            var cookieOptions = BuildCookieOptions();
            if (properties.IsPersistent && _refreshExpiresUtc.HasValue)
            {
                cookieOptions.Expires = _refreshExpiresUtc.Value.ToUniversalTime();
            }

            Options.CookieManager.AppendResponseCookie(
                Context,
                Options.Cookie.Name,
                cookieValue,
                cookieOptions);

            await ApplyHeaders(shouldRedirectToReturnUrl: false, properties: properties);
        }
    }

    protected async override Task HandleSignInAsync(ClaimsPrincipal user, AuthenticationProperties properties)
    {
        if (user == null)
        {
            throw new ArgumentNullException(nameof(user));
        }

        properties = properties ?? new AuthenticationProperties();

        _signInCalled = true;

        // Process the request cookie to initialize members like _sessionKey.
        await EnsureCookieTicket();
        var cookieOptions = BuildCookieOptions();

        var signInContext = new CookieSigningInContext(
            Context,
            Scheme,
            Options,
            user,
            properties,
            cookieOptions);

        DateTimeOffset issuedUtc;
        if (signInContext.Properties.IssuedUtc.HasValue)
        {
            issuedUtc = signInContext.Properties.IssuedUtc.Value;
        }
        else
        {
            issuedUtc = Clock.UtcNow;
            signInContext.Properties.IssuedUtc = issuedUtc;
        }

        if (!signInContext.Properties.ExpiresUtc.HasValue)
        {
            signInContext.Properties.ExpiresUtc = issuedUtc.Add(Options.ExpireTimeSpan);
        }

        await Events.SigningIn(signInContext);

        if (signInContext.Properties.IsPersistent)
        {
            var expiresUtc = signInContext.Properties.ExpiresUtc ?? issuedUtc.Add(Options.ExpireTimeSpan);
            signInContext.CookieOptions.Expires = expiresUtc.ToUniversalTime();
        }

        var ticket = new AuthenticationTicket(signInContext.Principal, signInContext.Properties, signInContext.Scheme.Name);

        if (Options.SessionStore != null)
        {
            if (_sessionKey != null)
            {
                await Options.SessionStore.RemoveAsync(_sessionKey);
            }
            _sessionKey = await Options.SessionStore.StoreAsync(ticket);
            var principal = new ClaimsPrincipal(
                new ClaimsIdentity(
                    new[] { new Claim(SessionIdClaimType, _sessionKey, ClaimValueTypes.String, Options.ClaimsIssuer) },
                    Options.ClaimsIssuer));
            ticket = new AuthenticationTicket(principal, null, Scheme.Name);
        }

        var cookieValue = Options.TicketDataFormat.Protect(ticket, GetTlsTokenBinding());

        Options.CookieManager.AppendResponseCookie(
            Context,
            Options.Cookie.Name,
            cookieValue,
            signInContext.CookieOptions);

        var signedInContext = new CookieSignedInContext(
            Context,
            Scheme,
            signInContext.Principal,
            signInContext.Properties,
            Options);

        await Events.SignedIn(signedInContext);

        // Only redirect on the login path
        var shouldRedirect = Options.LoginPath.HasValue && OriginalPath == Options.LoginPath;
        await ApplyHeaders(shouldRedirect, signedInContext.Properties);

        Logger.AuthenticationSchemeSignedIn(Scheme.Name);
    }

    protected async override Task HandleSignOutAsync(AuthenticationProperties properties)
    {
        properties = properties ?? new AuthenticationProperties();

        _signOutCalled = true;

        // Process the request cookie to initialize members like _sessionKey.
        await EnsureCookieTicket();
        var cookieOptions = BuildCookieOptions();
        if (Options.SessionStore != null && _sessionKey != null)
        {
            await Options.SessionStore.RemoveAsync(_sessionKey);
        }

        var context = new CookieSigningOutContext(
            Context,
            Scheme,
            Options,
            properties,
            cookieOptions);

        await Events.SigningOut(context);

        Options.CookieManager.DeleteCookie(
            Context,
            Options.Cookie.Name,
            context.CookieOptions);

        // Only redirect on the logout path
        var shouldRedirect = Options.LogoutPath.HasValue && OriginalPath == Options.LogoutPath;
        await ApplyHeaders(shouldRedirect, context.Properties);

        Logger.AuthenticationSchemeSignedOut(Scheme.Name);
    }

    private async Task ApplyHeaders(bool shouldRedirectToReturnUrl, AuthenticationProperties properties)
    {
        Response.Headers[HeaderNames.CacheControl] = HeaderValueNoCache;
        Response.Headers[HeaderNames.Pragma] = HeaderValueNoCache;
        Response.Headers[HeaderNames.Expires] = HeaderValueEpocDate;

        if (shouldRedirectToReturnUrl && Response.StatusCode == 200)
        {
            // set redirect uri in order:
            // 1. properties.RedirectUri
            // 2. query parameter ReturnUrlParameter
            //
            // Absolute uri is not allowed if it is from query string as query string is not
            // a trusted source.
            var redirectUri = properties.RedirectUri;
            if (string.IsNullOrEmpty(redirectUri))
            {
                redirectUri = Request.Query[Options.ReturnUrlParameter];
                if (string.IsNullOrEmpty(redirectUri) || !IsHostRelative(redirectUri))
                {
                    redirectUri = null;
                }
            }

            if (redirectUri != null)
            {
                await Events.RedirectToReturnUrl(
                    new RedirectContext<CookieAuthenticationOptions>(Context, Scheme, Options, properties, redirectUri));
            }
        }
    }

    private static bool IsHostRelative(string path)
    {
        if (string.IsNullOrEmpty(path))
        {
            return false;
        }
        if (path.Length == 1)
        {
            return path[0] == '/';
        }
        return path[0] == '/' && path[1] != '/' && path[1] != '\\';
    }

    protected override async Task HandleForbiddenAsync(AuthenticationProperties properties)
    {
        var returnUrl = properties.RedirectUri;
        if (string.IsNullOrEmpty(returnUrl))
        {
            returnUrl = OriginalPathBase + OriginalPath + Request.QueryString;
        }
        var accessDeniedUri = Options.AccessDeniedPath + QueryString.Create(Options.ReturnUrlParameter, returnUrl);
        var redirectContext = new RedirectContext<CookieAuthenticationOptions>(Context, Scheme, Options, properties, BuildRedirectUri(accessDeniedUri));
        await Events.RedirectToAccessDenied(redirectContext);
    }

    protected override async Task HandleChallengeAsync(AuthenticationProperties properties)
    {
        var redirectUri = properties.RedirectUri;
        if (string.IsNullOrEmpty(redirectUri))
        {
            redirectUri = OriginalPathBase + OriginalPath + Request.QueryString;
        }

        var loginUri = Options.LoginPath + QueryString.Create(Options.ReturnUrlParameter, redirectUri);
        var redirectContext = new RedirectContext<CookieAuthenticationOptions>(Context, Scheme, Options, properties, BuildRedirectUri(loginUri));
        await Events.RedirectToLogin(redirectContext);
    }

    private string GetTlsTokenBinding()
    {
        var binding = Context.Features.Get<ITlsTokenBindingFeature>()?.GetProvidedTokenBindingId();
        return binding == null ? null : Convert.ToBase64String(binding);
    }
}`

3. Replaced private const string SessionIdClaim = "Microsoft.AspNetCore.Authentication.Cookies-SessionId"; with new property

/// <summary>
    /// Added this to overwrite default SessionIdClaim value
    /// </summary>
    public virtual string SessionIdClaimType
    {
        get { return string.IsNullOrEmpty(Options.SessionIdClaim) ? SessionIdClaim : Options.SessionIdClaim; }
    }

4. Added new extension method to use ExtendedCookieAuthenticationHandler.

public static class CookieExtentions
{
    public static AuthenticationBuilder AddExtendedCookie(this AuthenticationBuilder builder, string authenticationScheme, string displayName, Action<ExtendedCookieAuthenticationOptions> configureOptions)
    {
        builder.Services.TryAddEnumerable(ServiceDescriptor.Singleton<IPostConfigureOptions<ExtendedCookieAuthenticationOptions>, PostConfigureCookieAuthenticationOptions>());
        return builder.AddScheme<ExtendedCookieAuthenticationOptions, ExtendedCookieAuthenticationHandler>(authenticationScheme, displayName, configureOptions);
    }
}

5. Used new extension method in ConfigureServices method in startup.cs

.AddExtendedCookie("AuthScheme", "DisplayName", options =>
        {
            options.Cookie.Name = "CookieName";
            options.Cookie.Domain = ".domain.com";
            options.Cookie.HttpOnly = true;
            options.SlidingExpiration = true;
            options.Events = new CookieAuthenticationEvents()
            {
                //Sample how to add additional check for logged in User at Application Level.
                OnValidatePrincipal = async context => { await ValidateAsync(context); },
            };
            options.LoginPath = "/account/login";
            options.CookieManager = new ChunkingCookieManager();
            options.SessionIdClaim = "Microsoft.Owin.Security.Cookies-SessionId";
            options.TicketDataFormat = ticketDataFormat;
            //SessionStore is configured in PostConfigureCookieAuthenticationOptions with DI
            //options.SessionStore = //From DI
        });

View more solutions

Comments

[Tratcher]

ITicketStore and data protection should be unrelated. Note you don't need a special data protector for cookies, configuring the central one should be adequate. Also, calling BuildServiceProvider in Configure Services should be avoided, it messes up your service lifetimes.

[Daath]

"Also, calling BuildServiceProvider in Configure Services should be avoided, it messes up your service lifetimes" Yea I knew that was a dirty way to do it, even though I didn't know why exactly. I'll change that, thank you. Also, do you have any idea why adding the SessionStore line would break the cookie persistence across the domain? I've tested with and without the session store, and it only stops working when I have it included. I'm pretty much at a loss.

[Tratcher]

Your ticket store is a per machine memory cache. You need to implement a distributed cache instead.

[Tratcher]

In other words, I expect your data protection is fine but the cached identities are missing from the other machines.

[Daath]

@Tratcher Ah, that's the missing piece! Thank you very much - I'm going to work on implementing that.

[djack109]

@Daath What's the alternative to BuildServiceProvider please. I've only just started looking into this and can make neither hide nor hair of whats going on. I can't even find and tutorial. Interestingly ITicket store brings up articles about cigarettes after sex which I thought was funny.

[Keith]

@Tratcher could you clarify "Note you don't need a special data protector for cookies, configuring the central one should be adequate"? As far as I can tell ConfigureApplicationCookie ignores whatever IDistributedCache or ITicketStore you've registered and just uses the in memory default. How do I register a custom DI ticket store without BuildServiceProvider() in ConfigureApplicationCookie?

[Tratcher]

I wasn't taking about the ITicketStore, I said data protection, as in the DataProtectionProvider and TicketDataFormat options.

[Tratcher]

See github.com/dotnet/aspnetcore/issues/18772 for alternatives to BuildServiceProvider. There's an unintuitive option now and we'll add a better one.

[dhysong]

Did you ever find a way to overcome this? Recompiling Katana just isn't an option for me.

[Anthony Valeri]

I tried another approach involving adding both claims to the cookie, it seems to work, but I am still testing it. I would be curious to know if there are any issues with that approach (adding both claims to the cookie)

[toy]

hey @dotnetDe - in section 2 you say "Options.CookieManager.GetRequestCookie" - what namespace is options? the only options i have is under ms.extenstions.options and it doesnt contain a cookie manager

[dotNet Decoder]

this is where you define options.SessionIdClaim = "Microsoft.Owin.Security.Cookies-SessionId";

[Ran Sagy]

@AnthonyValeri Was there a conclusion to your tests of the double-claim approach? I'm planning the same (although likely during the cookie creation side - instead of replacing the claim on every call to the consuming side) and wondred if your tests bore any fruits, good or bad.

[Anthony Valeri]

@RanSagy Yes, I ended up implementing a custom CookieAuthenticationHandler the way dotNet Decoder described above along with the double claims and it has been working fine for me in production (almost one year now), I implemented it 6/15/2019. I like your approach of doing it on the cookie creation side though as it is more efficient.

[Ran Sagy]

@AnthonyValeri Great to know, Thanks for the update! Wanted to make sure there weren't any complications from the double claims that popped up.

[Andreas Vendel]

@RanSagy I went with the approach you mention by creating a ticket data format that adds the other session id claim during cookie creation. See stackoverflow.com/a/65630992/587277.