他们提出的问题如下所述

A cookie linked with session Management is called AspNet.ApplicationCookie. When entered manually,the application authenticates the user. Even though the user logs out from the Application,the cookie is still valid. This means,the old session cookie can be used for a valid authentication within unlimited timeframe. In the moment the old value is inserted,the application accepts it and replaces it with a newly generated cookie. Therefore,if the attacker gains access to one of the existing cookies,the valid session will be created,with the same access as in the past.

我们正在使用ASP.NEt Identity 2.2

这是我们在帐户控制器上的注销操作

[HttpPost]
    [ValidateAntiForgeryToken]
    public ActionResult logoff()
    {
        AuthenticationManager.SignOut();
        return RedirectToAction("Login","Account");
    }

在startup.auth.cs中

app.UseCookieAuthentication(new CookieAuthenticationOptions
        {
            AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,LoginPath = new PathString("/Account/Login"),ExpireTimeSpan = TimeSpan.FromHours(24.0),Provider = new CookieAuthenticationProvider
            {
                // Enables the application to validate the security stamp when the user logs in.
                // This is a security feature which is used when you change a password or add an external login to your account.  
                OnValidateIdentity = SecurityStampValidator
             .OnValidateIdentity<ApplicationUserManager,ApplicationUser,int>(
                 validateInterval: TimeSpan.FromMinutes(1.0),regenerateIdentityCallback: (manager,user) =>
                     user.GenerateUserIdentityAsync(manager),getUserIdCallback: (id) => (Int32.Parse(id.GetUserId())))

            }
        });

我原本以为该框架会处理一个旧的会话cookie无效,但浏览Owin.Security源代码却没有.

如何在注销时使会话cookie无效？

编辑Jamie Dunstan的建议我添加了AuthenticationManager.SignOut(DefaultAuthenticationTypes.ApplicationCookie);但后来没有任何区别.我仍然可以退出应用程序,在Fiddler中克隆先前经过身份验证的请求,并让应用程序接受它.

编辑：我更新的logoff方法

[HttpPost]
    [ValidateAntiForgeryToken]
    public async Task<ActionResult> logoff()
    {
        var user = await UserManager.FindByNameAsync(User.Identity.Name);

        AuthenticationManager.SignOut(DefaultAuthenticationTypes.ApplicationCookie);
        await UserManager.UpdateSecurityStampAsync(user.Id);

        return RedirectToAction("Login","Account");
    }