Handle auth schemes in cookie names #25279
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
HaoK
reviewed
Aug 26, 2020
HaoK
approved these changes
Aug 26, 2020
|
Approved for RC1. |
|
/azp run |
|
Azure Pipelines successfully started running 2 pipeline(s). |
|
/azp run |
|
Azure Pipelines successfully started running 2 pipeline(s). |
|
Merge please. |
akunzai
added a commit
to akunzai/GSS.Authentication.CAS
that referenced
this pull request
Dec 22, 2020
akunzai
added a commit
to akunzai/GSS.Authentication.CAS
that referenced
this pull request
Dec 22, 2020
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
#23579 removed cookie name encoding due to security concerns outlined in #23578. The result is that people creating cookies need to provide valid names. #25266 identified a scenario where the ASP.NET authentication libraries generate cookie names using a secondary value without ensuring it makes a valid cookie name. The two affected scenarios are remote authentication and cookie authentication.
The downlevel patches (#24264) used a more conservative mitigation that does not introduce the same regression. We opted not to use the same fix in 5.0 because it has known limitations.
Fix
In the remote authentication scenario the authentication scheme name can be removed from the correlation cookie, it's not providing any value there.
In the cookie auth scenario the authentication scheme is used to distinguish between cookie instances. We'll encode only the authentication scheme in the cookie name to ensure it makes a valid cookie name. Limiting the encoding to the auth scheme name avoids the concerns in the original security issue.
Customer Impact
Regression?
Yes, in preview 8 as a side effect of a security change #23579
Risk
Low
cc: @martincostello