OWIN - 清除無效WSFederation Cookie

Question

我實施了一個ASP.Net Web API 2項目，並使用ADFS cookie身份驗證並將其託管在IIS上。一切正常。

但是，一些客戶端已經得到舊的cookie，由於配置更改而變爲無效。

[CryptographicException: Key not valid for use in specified state. 
] 
    System.Security.Cryptography.ProtectedData.Unprotect(Byte[] encryptedData, Byte[] optionalEntropy, DataProtectionScope scope) +447 
    System.IdentityModel.ProtectedDataCookieTransform.Decode(Byte[] encoded) +49 

[InvalidOperationException: ID1073: A CryptographicException occurred when attempting to decrypt the cookie using the ProtectedData API (see inner exception for details). If you are using IIS 7.5, this could be due to the loadUserProfile setting on the Application Pool being set to false. ] 
    System.IdentityModel.ProtectedDataCookieTransform.Decode(Byte[] encoded) +329 
    System.IdentityModel.Tokens.SessionSecurityTokenHandler.ApplyTransforms(Byte[] cookie, Boolean outbound) +167 
    System.IdentityModel.Tokens.SessionSecurityTokenHandler.ReadToken(XmlReader reader, SecurityTokenResolver tokenResolver) +826 
    System.IdentityModel.Tokens.SessionSecurityTokenHandler.ReadToken(Byte[] token, SecurityTokenResolver tokenResolver) +92 
    System.IdentityModel.Services.SessionAuthenticationModule.ReadSessionTokenFromCookie(Byte[] sessionCookie) +569 
    System.IdentityModel.Services.SessionAuthenticationModule.TryReadSessionTokenFromCookie(SessionSecurityToken& sessionToken) +306 
    System.IdentityModel.Services.SessionAuthenticationModule.OnAuthenticateRequest(Object sender, EventArgs eventArgs) +159 
    System.Web.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +142 
    System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) +92 

最明顯的解決方法是清除餅乾：餅乾這類引起打電話給我的API時，下面的錯誤。不過，我很可能會在將來再次更改Cookie配置，因此我想要從API中自動清除所有無效的Cookie。

我試過添加一個自定義的OWIN中間件和覆蓋IExceptionHandler。

這裏是我的WIF的配置：

<system.identityModel> 
    <identityConfiguration> 
    <audienceUris> 
     <add value="https://my.web-api.com" /> 
    </audienceUris> 
    <issuerNameRegistry type="System.IdentityModel.Tokens.ValidatingIssuerNameRegistry, System.IdentityModel.Tokens.ValidatingIssuerNameRegistry"> 
     <authority name="ADFS"> 
     <keys> 
      <add thumbprint="--a thumbprint--" /> 
     </keys> 
     <validIssuers> 
      <add name="http://my.adfs.com/adfs/services/trust" /> 
     </validIssuers> 
     </authority> 
    </issuerNameRegistry> 
    </identityConfiguration> 
</system.identityModel> 
<system.identityModel.services> 
    <federationConfiguration> 
    <wsFederation issuer="https://my.adfs.com/adfs/ls" realm="https://my.web-api.com" requireHttps="true" passiveRedirectEnabled="false" 
        persistentCookiesOnPassiveRedirects="true" /> 
    <cookieHandler name="my.cookie" path="/" persistentSessionLifetime="7.0:0:0" /> 
    <serviceCertificate> 
     <certificateReference x509FindType="FindBySubjectName" findValue="my.web-api.com" storeLocation="LocalMachine" storeName="My" /> 
    </serviceCertificate> 
    </federationConfiguration> 
</system.identityModel.services> 

這裏是我的Startup類：

public class Startup 
{ 
    public void Configuration(IAppBuilder appBuilder) 
    { 
     var config = new HttpConfiguration(); 

     config.Services.Replace(typeof(IExceptionHandler), new CryptographicExceptionHandler()); 
     WebApiConfig.Register(config); 
     appBuilder.UseWebApi(config); 
     appBuilder.Use<ClearInvalidCookiesMiddleware>(); 
    } 
} 

不管裏面有什麼CryptographicExceptionHandler和ClearInvalidCookiesMiddleware，他們的代碼是不是叫和我得到500錯誤。我也嘗試在UseWebApi之前移動ClearInvalidCookiesMiddleware。

我的目標是添加Set-Cookie響應頭來清除無效的cookie並返回401或重定向。

如何讓OWIN在這種情況下自定義響應？

Answer 1

溶液呈覆蓋SessionAuthenticationModule.OnAuthenticateRequest在例外的情況下，撥打SignOut()：

class ClearInvalidCookiesSessionAuthenticationModule : SessionAuthenticationModule 
{ 
    protected override void OnAuthenticateRequest(object sender, EventArgs eventArgs) 
    { 
     try 
     { 
      base.OnAuthenticateRequest(sender, eventArgs); 
     } 
     catch(InvalidOperationException ex) when (ex.InnerException is CryptographicException) // Invalid cookie signing key 
     { 
      SignOut(); 
     } 
     catch(System.Xml.XmlException) // Invalid cookie structure 
     { 
      SignOut(); 
     } 
    } 
} 

，而不是使用默認的繼承類，應插入下面的行內的Web.config：

<system.webServer> 
    <modules ...> 
    <!-- Insert the line below or replace existing SessionAuthenticationModule --> 
    <add name="SessionAuthenticationModule" preCondition="managedHandler" 
     type="MyNamespace.ClearInvalidCookiesSessionAuthenticationModule, MyAssembly" /> 
    ... 
    </modules> 
... 
</system.webServer>