asp.net core - How to change default name of OpenID Connect middleware (nonce and correlation) cookies -


i'm using 2 asp.net core middlewares openid connect , cookie authentication below:

app.usecookieauthentication(new cookieauthenticationoptions {     authenticationscheme = "cookie",     cookiename = "clientcookiename",     cookiehttponly = true,     cookiesecure = _hostingenvironment.isdevelopment() ? cookiesecurepolicy.sameasrequest : cookiesecurepolicy.always,     automaticauthenticate = true,     automaticchallenge = false,     expiretimespan = timespan.fromminutes(60) });  var oidcoptions = new openidconnectoptions {     authenticationscheme = "oidc",     signinscheme = "cookie",                     ... }; app.useopenidconnectauthentication(oidcoptions);

during login in web application results in default cookies related nonce , correlation (exported browser developer tools):

{     "domain": "localhost",     "expirationdate": 1478762475.872038,     "hostonly": true,     "httponly": true,     "name": ".aspnetcore.openidconnect.nonce.cfdj...ihrrfqid0rw",     "path": "/",     "samesite": "no_restriction",     "secure": false,     "session": false,     "storeid": "0",     "value": "n",     "id": 1   },   {     "domain": "localhost",     "expirationdate": 1478762474.872093,     "hostonly": true,     "httponly": true,     "name": ".aspnetcore.correlation.oidc.apx...xlcfhuc...hcq8",     "path": "/",     "samesite": "no_restriction",     "secure": false,     "session": false,     "storeid": "0",     "value": "n",     "id": 2   }
  1. what responsibility of these cookies?
  2. how change cookiename of these cookies?
  3. will changing cookiename of these cookies have consequences in other place?

what responsibility of these cookies?

the correlation , nonce cookies respectively used prevent xsrf/session fixation attacks , replay attacks. essential part of security checks used openid connect middleware.

how change cookiename of these cookies?

you can't. in both cases, cookie name not configurable (it's prefixed hardcoded part).

the relevant code can found here:


Comments

Post a Comment

Popular posts from this blog

aws api gateway - SerializationException in posting new Records via Dynamodb Proxy Service in API -

i getting "__type": "com.amazon.coral.service#serializationexception" as reply in postman & in test console in api gateway trying post record directly dynamodb using api proxy services.. referring aws article - https://aws.amazon.com/blogs/compute/using-amazon-api-gateway-as-a-proxy-for-dynamodb/ here's mapping { "tablename": "tablenamegoeshere", "item": { "id" : "$context.requestid" "eventname" : "$input.path('$.eventname')", "timestamp" : $input.path('$.timestamp'), "answers": "$util.parsejson($input.path('$.answers'))" } } update: did asked ... , worked if try add array of json objects gives me above same error - here's trying now. please - couldnt find on google well #set($inputroot = $input.path('$')) { "tablename": "answer", "item": {
Read more

asp.net - Problems sending emails from forum -

i have been redesigning site has message board, has been written guy looked after site. it has few problems , written in .asp , uses .mdb files database. you can see whole thing here . feel free post if helps, test thing have set using original files , new database. the basic problem when posts message, supposed email sent them, have posted it. when replies, originator supposed message, replier has been posted. i’d have thought @ point in process there should script/file in postmessage.asp? the postmessage.asp page below. <% option explicit %> <!-- #include virtual="common/adovbs.inc" --> <html> <head> <meta http-equiv="content-type" content="text/html; charset=windows-1252"> <meta name="generator" content="microsoft frontpage 4.0"> <meta name="progid" content="frontpage.editor.document"> <title>new page 2</title> <base target="_self"
Read more