Sholo.Web.Security/Analysis/RequestAnalyzer.cs
/// <summary>
/// Perform analysis of the FormsAuthenticationCookie supplied
/// </summary>
/// <param name="cookie">The FormsAuthenticationCookie to validate</param>
/// <returns>A FormsAuthenticationCookieAnalysis object containing the results of the analysis</returns>
Perform analysis of the FormsAuthenticationCookie supplied
Perform analysis of the FormsAuthenticationCookie supplied
public static FormsAuthenticationCookieAnalysis AnalyzeFormsAuthenticationCookie(HttpCookie cookie)
        {
            FormsAuthenticationCookieAnalysis analysis = new FormsAuthenticationCookieAnalysis { CookieExists = (cookie != null) };
            if (analysis.CookieExists)
            {
                FormsAuthenticationTicket formsAuthenticationTicket = null;
                analysis.FormsAuthenticationCookie = cookie;
                if (cookie != null)
                {
                    analysis.IsCookieFormsAuthCookie = (cookie.Name == FormsAuthentication.FormsCookieName);
                    analysis.IsDomainValid = (cookie.Domain == FormsAuthentication.CookieDomain);
                    analysis.IsExpired = (DateTime.Now.CompareTo(cookie.Expires) > 0 && cookie.Expires.CompareTo(DateTime.MinValue) != 0);
                    analysis.IsPathValid = (cookie.Path == FormsAuthentication.FormsCookiePath);
                    analysis.IsSecureValid = (cookie.Secure == FormsAuthentication.RequireSSL);
                    analysis.HasValue = !string.IsNullOrEmpty(cookie.Value);
                }
                analysis.ValueDecrypts = analysis.HasValue;
                if (analysis.HasValue)
                {
                    try
                    {
                        if (cookie != null && cookie.Value != null)
                        {
                            formsAuthenticationTicket = FormsAuthentication.Decrypt(cookie.Value);
                            if (formsAuthenticationTicket != null)
                            {
                                analysis.ValueDecrypts = true;
                                analysis.SetFormsAuthenticationTicket(formsAuthenticationTicket);
                            }
                        }
                        else
                        {
                            analysis.ValueDecrypts = false;
                        }
                    }
                    catch
                    {
                        analysis.ValueDecrypts = false;
                    }
                }
                analysis.IsValid =
                    analysis.IsCookieFormsAuthCookie &&
                    analysis.IsDomainValid &&
                    !analysis.IsExpired &&
                    analysis.IsPathValid &&
                    analysis.IsSecureValid &&
                    ((analysis.HasValue && analysis.ValueDecrypts && formsAuthenticationTicket != null) || !analysis.HasValue);
                if (!analysis.IsValid)
                {
                    analysis.IsMalicious =
                        !analysis.IsCookieFormsAuthCookie ||
                        !analysis.IsDomainValid ||
                        !analysis.IsPathValid ||
                        (analysis.HasValue && !analysis.ValueDecrypts) ||
                        !analysis.IsSecureValid;
                }
            }
            else
            {
                analysis.IsValid = false;
                analysis.IsMalicious = false;
            }
            return analysis;
        }
public static FormsAuthenticationCookieAnalysis AnalyzeFormsAuthenticationCookie ( HttpCookie cookie ) { FormsAuthenticationCookieAnalysis analysis = new FormsAuthenticationCookieAnalysis { CookieExists = ( cookie != null ) } ; if ( analysis . CookieExists ) { FormsAuthenticationTicket formsAuthenticationTicket = null ; analysis . FormsAuthenticationCookie = cookie ; if ( cookie != null ) { analysis . IsCookieFormsAuthCookie = ( cookie . Name == FormsAuthentication . FormsCookieName ) ; analysis . IsDomainValid = ( cookie . Domain == FormsAuthentication . CookieDomain ) ; analysis . IsExpired = ( DateTime . Now . CompareTo ( cookie . Expires ) > 0 && cookie . Expires . CompareTo ( DateTime . MinValue ) != 0 ) ; analysis . IsPathValid = ( cookie . Path == FormsAuthentication . FormsCookiePath ) ; analysis . IsSecureValid = ( cookie . Secure == FormsAuthentication . RequireSSL ) ; analysis . HasValue = ! string . IsNullOrEmpty ( cookie . Value ) ; } analysis . ValueDecrypts = analysis . HasValue ; if ( analysis . HasValue ) { try { if ( cookie != null && cookie . Value != null ) { formsAuthenticationTicket = FormsAuthentication . Decrypt ( cookie . Value ) ; if ( formsAuthenticationTicket != null ) { analysis . ValueDecrypts = true ; analysis . SetFormsAuthenticationTicket ( formsAuthenticationTicket ) ; } } else { analysis . ValueDecrypts = false ; } } catch { analysis . ValueDecrypts = false ; } } analysis . IsValid = analysis . IsCookieFormsAuthCookie && analysis . IsDomainValid && ! analysis . IsExpired && analysis . IsPathValid && analysis . IsSecureValid && ( ( analysis . HasValue && analysis . ValueDecrypts && formsAuthenticationTicket != null ) || ! analysis . HasValue ) ; if ( ! analysis . IsValid ) { analysis . IsMalicious = ! analysis . IsCookieFormsAuthCookie || ! analysis . IsDomainValid || ! analysis . IsPathValid || ( analysis . HasValue && ! analysis . ValueDecrypts ) || ! analysis . IsSecureValid ; } } else { analysis . IsValid = false ; analysis . IsMalicious = false ; } return analysis ; }
Perform analysis of the FormsAuthenticationCookie supplied
Perform analysis of the FormsAuthenticationCookie supplied
A FormsAuthenticationCookieAnalysis object containing the results of the analysis
A FormsAuthenticationCookieAnalysis object containing the results of the analysis
cookie
HttpCookie
The FormsAuthenticationCookie to validate
The FormsAuthenticationCookie to validate