Id token validation incase of MVC application

Help
,
1

Hi Team,
I have a Sample MVC application downloaded from Auth0. The configuration is the default configuration there with the sample application.
Included the below middleware
app.UseAuthentication();
app.UseAuthorization();
Performing the following steps:

  1. Ran and logged in to the application successfully.
  2. Later I went to my Auth0 account and changed the Id token expiration time to 10 sec in my application configuration.
  3. Now I ran my sample application again, logged in and wait for 15 second.
  4. After 15 second I browsed to an [Authorize] end point.
  5. Expected: Application should show some token expiration message and should not allow to browse to [Authorize] end point.
    Actual: Application is not showing any token expiration message and allow to browse to [Authorize] end point.
    Please provide suggestion on how to validate an Id token in MVC application, so that application should not allow to browse to [Authorize] end point.
4

Hi @pradeepta.meher ,

I noticed that you opened a Support ticket for the same issue. Once our DSE solves it, I will share the details on this topic to make it beneficial to other folks in our Community as well!

Thanks!

5

We use the default cookie middleware, and the OIDC package from aspnetcore. Our SDK doesnt handle any of that.The Microsoft.AspNetCore.Authentication.Cookies package allows u to specify a SessionStore (which implements ITicketStore) that can be used to store things server side in a session. If not, everything goes in the cookie."

We register the cookie middleware and use default config, but u can still configure the cookie middleware the way you like. If you would like to configure the Microsoft.AspNetCore.Authentication.Cookie middleware to use a session, you can configure it as such:

public void ConfigureServices(IServiceCollection services)
{
     services
               .AddAuth0WebAppAuthentication(PlaygroundConstants.AuthenticationScheme, options =>
               {
                   options.Domain = Configuration["Auth0:Domain"];
                   options.ClientId = Configuration["Auth0:ClientId"];
                   options.ClientSecret = Configuration["Auth0:ClientSecret"];
               });
     // Configure a custom ITicketStore to store the Identity Information on the server
     services.AddTransient<ITicketStore, CustomInMemoryTicketStore>();
     // Configure the Cookie Middleware to use the CustomInMemoryTicketStore
     services.AddSingleton<IPostConfigureOptions<CookieAuthenticationOptions>, ConfigureCookieAuthenticationOptions>();
}

and

public class ConfigureCookieAuthenticationOptions
  : IPostConfigureOptions<CookieAuthenticationOptions>
    {
        private readonly ITicketStore _ticketStore;

        public ConfigureCookieAuthenticationOptions(ITicketStore ticketStore)
        {
            _ticketStore = ticketStore;
        }

        public void PostConfigure(string name,
                 CookieAuthenticationOptions options)
        {
            options.SessionStore = _ticketStore;
        }
    }

Every request will then call the below TicketStore’s “RetrieveAsync” method:

public class CustomInMemoryTicketStore : ITicketStore
    {
        private readonly IMemoryCache _cache;

        public CustomInMemoryTicketStore(IMemoryCache cache)
        {
            _cache = cache;
        }

        public Task RemoveAsync(string key)
        {
            _cache.Remove(key);

            return Task.CompletedTask;
        }

        public Task<AuthenticationTicket> RetrieveAsync(string key)
        {
            var ticket = _cache.Get<AuthenticationTicket>(key);

            return Task.FromResult(ticket);
        }

        public Task RenewAsync(string key, AuthenticationTicket ticket)
        {
            _cache.Set(key, ticket);

            return Task.CompletedTask;
        }

        public Task<string> StoreAsync(AuthenticationTicket ticket)
        {
            var key = ticket.Principal.Claims
              .First(c => c.Type == "sid").Value;

            _cache.Set(key, ticket);

            return Task.FromResult(key);
        }
    }

The above TicketStore simply stores in memory, but shows how you can add in a session layer by configuring the Microsoft.AspNetCore.Aurthentication.Cookies middleware.