What is ASP.NET Identity's IUserSecurityStampStore<TUser> interface?

asp.net asp.net-mvc asp.net-mvc-5 asp.net-identity

Looking at ASP.NET Identity (new membership implementation in ASP.NET), I came across this interface when implementing my own UserStore:

//Microsoft.AspNet.Identity.Core.dll

namespace Microsoft.AspNet.Identity
{ 
    public interface IUserSecurityStampStore<TUser> :
    {
        // Methods
        Task<string> GetSecurityStampAsync(TUser user);
        Task SetSecurityStampAsync(TUser user, string stamp);
    }
}

IUserSecurityStampStore is implemented by the default EntityFramework.UserStore<TUser> which essentially get and set the TUser.SecurityStamp property.

After some more digging, it appears that a SecurityStamp is a Guid that is newly generated at key points in the UserManager (for example, changing passwords).

I can't really decipher much beyond this since I'm examining this code in Reflector. Almost all the symbol and async information has been optimized out.

Also, Google hasn't been much help.

Questions are:

What is a SecurityStamp in ASP.NET Identity and what is it used for?

Does the SecurityStamp play any role when authentication cookies are created?

Are there any security ramifications or precautions that need to be taken with this? For example, don't send this value downstream to clients?

Update (9/16/2014)

Source code available here:

https://github.com/aspnet/Identity/

https://github.com/aspnet/Security/

@TryingToImprove, the new Identity store and dependant OWIN middleware is designed to be highly customizable. Like SimpleMembership, there is an out-of-the-box implementation leveraging the latest EF on SQL Express. But the Schema, Data querying method, Database source, and even middle ware are customizable around your specific puprose. What's more, the implementation released by MS is itself still evolving. That's why everyone struggles to find a specific definition.

niico

This is meant to represent the current snapshot of your user's credentials. So if nothing changes, the stamp will stay the same. But if the user's password is changed, or a login is removed (unlink your google/fb account), the stamp will change. This is needed for things like automatically signing users/rejecting old cookies when this occurs, which is a feature that's coming in 2.0.

Identity is not open source yet, its currently in the pipeline still.

Edit: Updated for 2.0.0. So the primary purpose of the SecurityStamp is to enable sign out everywhere. The basic idea is that whenever something security related is changed on the user, like a password, it is a good idea to automatically invalidate any existing sign in cookies, so if your password/account was previously compromised, the attacker no longer has access.

In 2.0.0 we added the following configuration to hook the OnValidateIdentity method in the CookieMiddleware to look at the SecurityStamp and reject cookies when it has changed. It also automatically refreshes the user's claims from the database every refreshInterval if the stamp is unchanged (which takes care of things like changing roles etc)

app.UseCookieAuthentication(new CookieAuthenticationOptions {
    AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
    LoginPath = new PathString("/Account/Login"),
    Provider = new CookieAuthenticationProvider {
        // Enables the application to validate the security stamp when the user logs in.
        // This is a security feature which is used when you change a password or add an external login to your account.  
        OnValidateIdentity = SecurityStampValidator.OnValidateIdentity<ApplicationUserManager, ApplicationUser>(
            validateInterval: TimeSpan.FromMinutes(30),
            regenerateIdentity: (manager, user) => user.GenerateUserIdentityAsync(manager))
    }
});

If your app wants to trigger this behavior explicitly, it can call:

UserManager.UpdateSecurityStampAsync(userId);

What if I am migrating data from MVC4 table structure? Can I just leave that field blank? Or is it going to screw things up somehow?

You can just have it return the ID or something constant to effectively make it a no-op. Null/"" would probably work as well.

Does the UserManager.UpdateSecurityStampAsync(userId) work for UseOAuthBearerTokens?

No, OAuthBearerTokens are not affected currently.

The UseCookieAuthentication is deprecated by now. I managed to configure it using services.Configure<SecurityStampValidatorOptions>(o => o.ValidationInterval = TimeSpan.FromSeconds(10));.

riezebosch

The UseCookieAuthentication is deprecated by now. I managed to configure it using

services.Configure<SecurityStampValidatorOptions>(o => 
    o.ValidationInterval = TimeSpan.FromSeconds(10));

Moved from reply to answer per request.

Does this work if I am using ASP.NET (not Core)? I am confused. If I go to the Asp Identity Repo, it say it's for Asp.NET Core.

KierenH

I observed the SecurityStamp to be required for token verification.

To repo: Set SecurityStamp to null in the databsae Generate a token (works ok) Verify token (fails)

That's got to be a bug. It makes no sense to generate a token that cannot be verified.

The bug is that it lets you generate a token when the security stamp is blank. (imho GenerateEmailConfirmationToken should fail if there is no security stamp. See this answer: stackoverflow.com/a/29926407/1058214)

What is ASP.NET Identity's IUserSecurityStampStore<TUser> interface?

Follow WeChat

Want to stay one step ahead of the latest teleworks?

相似问题

Platform

Support

Contact US