Skip to main content

Insecure session management - Change Password

Need​

Secure session management after password changes

Context​

  • Usage of C# 7.0 for modern language features and enhancements
  • Usage of Microsoft.AspNetCore.Mvc for building web applications with ASP.NET Core
  • Usage of Microsoft.AspNetCore.Identity for managing user authentication and authorization in ASP.NET Core applications

Description​

Non compliant code​

public class AccountController : Controller
{
    private readonly UserManager<ApplicationUser> _userManager;

    public AccountController(UserManager<ApplicationUser> userManager)
    {
        _userManager = userManager;
    }

    [HttpPost]
    public async Task<IActionResult> ChangePassword(ChangePasswordViewModel model)
    {
        if (!ModelState.IsValid)
        {
            return View(model);
        }

        var user = await _userManager.GetUserAsync(User);
        if (user == null)
        {
            return NotFound($"Unable to load user with ID '{_userManager.GetUserId(User)}'.");
        }

        var changePasswordResult = await _userManager.ChangePasswordAsync(user, model.OldPassword, model.NewPassword);
        if (!changePasswordResult.Succeeded)
        {
            return View(model);
        }

        return RedirectToAction("Index", "Home");
    }
}

In the code above, the ChangePassword method is responsible for changing the user's password. The method first validates the input model, then retrieves the current user from the session, and finally, changes the password if the old password is correct.

The vulnerability lies in the fact that the session remains active even after the password is changed. This means that if the user's session was compromised before the password change, the attacker will still have access to the session after the password change. This is a security risk because the attacker can continue to perform actions on behalf of the user, even though the user has changed their password in an attempt to secure their account.

A secure practice would be to invalidate the user's session after a password change, forcing all clients to re-authenticate. This would ensure that if an attacker had access to the user's session, they would be locked out after the password change.

Steps​

  • Implement session expiration after a password change.
  • Invalidate the existing session and generate a new session ID.
  • Update the session ID in the authentication cookie.
  • Ensure that the user is redirected to the login page after a password change.

Compliant code​

public class AccountController : Controller
{
    private readonly UserManager<ApplicationUser> _userManager;
    private readonly SignInManager<ApplicationUser> _signInManager;

    public AccountController(UserManager<ApplicationUser> userManager, SignInManager<ApplicationUser> signInManager)
    {
        _userManager = userManager;
        _signInManager = signInManager;
    }

    [HttpPost]
    public async Task<IActionResult> ChangePassword(ChangePasswordViewModel model)
    {
        if (!ModelState.IsValid)
        {
            return View(model);
        }

        var user = await _userManager.GetUserAsync(User);
        if (user == null)
        {
            return NotFound($"Unable to load user with ID '{_userManager.GetUserId(User)}'.");
        }

        var changePasswordResult = await _userManager.ChangePasswordAsync(user, model.OldPassword, model.NewPassword);
        if (!changePasswordResult.Succeeded)
        {
            return View(model);
        }

        // Invalidate the existing session and generate a new session ID
        await _signInManager.SignOutAsync();

        // Redirect the user to the login page after a password change
        return RedirectToAction("Login", "Account");
    }
}

The updated code now includes a SignInManager&lt;ApplicationUser> in the AccountController constructor. This SignInManager is used to manage the user's session.

After the password change is successful, the SignOutAsync method of the SignInManager is called. This method invalidates the existing session and generates a new session ID. The session ID in the authentication cookie is also updated.

Finally, the user is redirected to the login page after the password change. This ensures that the user has to log in again with their new password, thus securing the session management after a password change.

References​

Last updated on