Sholo.Web.Security/Analysis/RequestAnalyzer.cs
/// <summary>
/// Perform analysis of the UserAuthenticationTicket supplied
/// </summary>
/// <param name="contextInformation">Context information derived from the current request</param>
/// <param name="cookieAnalysis">The result of the FormsAuthenticationCookie analysis</param>
/// <param name="ticketAnalysis">The result of the FormsAuthenticationTicket analysis</param>
/// <param name="userAuthenticationTicket">The UserAuthenticationTicket to inspect</param>
/// <param name="enforceHostAddressValidation">Indicates whether to enforce that the ticket was provided from the same IP address for which it created</param>
/// <returns>A UserAuthenticationTicketAnalysis object containing the results of the analysis</returns>
Perform analysis of the UserAuthenticationTicket supplied
Perform analysis of the UserAuthenticationTicket supplied
public static UserAuthenticationTicketAnalysis AnalyzeServerAuthenticationTicket(ContextInformation contextInformation, FormsAuthenticationCookieAnalysis cookieAnalysis, FormsAuthenticationTicketAnalysis ticketAnalysis, UserAuthenticationTicket userAuthenticationTicket, bool enforceHostAddressValidation)
        {
            UserAuthenticationTicketAnalysis analysis = new UserAuthenticationTicketAnalysis();
            HttpCookie formsAuthCookie = cookieAnalysis.FormsAuthenticationCookie;
            FormsAuthenticationTicket formsAuthTicket = ticketAnalysis.FormsAuthenticationTicket;
            analysis.TicketExists = (userAuthenticationTicket != null);
            if (analysis.TicketExists)
            {
                analysis.UserAuthenticationTicket = userAuthenticationTicket;
                if (userAuthenticationTicket != null)
                {
                    analysis.CookieDomainMatch = (userAuthenticationTicket.CookieDomain == formsAuthCookie.Domain);
                    analysis.CookiePathMatch = (userAuthenticationTicket.CookiePath == formsAuthTicket.CookiePath && formsAuthTicket.CookiePath == formsAuthCookie.Path);
                    analysis.CookieSecureMatch = (userAuthenticationTicket.CookieSecure == formsAuthCookie.Secure);
                    analysis.CookieNameMatch = (userAuthenticationTicket.CookieName == formsAuthCookie.Name);
                    analysis.TicketPersistenceMatch = (userAuthenticationTicket.TicketIsPersistent == formsAuthTicket.IsPersistent);
                    analysis.TicketIssueDateMatch = (DateTime.Compare(userAuthenticationTicket.TicketIssueDate, formsAuthTicket.IssueDate) == 0);
                    analysis.TicketUsernameMatch = (userAuthenticationTicket.Username == formsAuthTicket.Name);
                    analysis.TicketVersionMatch = (userAuthenticationTicket.TicketVersion == formsAuthTicket.Version);
                    analysis.TicketHashMatch = (userAuthenticationTicket.TicketHash == ticketAnalysis.TicketHash);
                    analysis.HostAddressMatch = (userAuthenticationTicket.HostAddress == contextInformation.HostAddress);
                }
                analysis.IsValid =
                    analysis.CookieDomainMatch &&
                    analysis.CookiePathMatch &&
                    analysis.CookieSecureMatch &&
                    analysis.CookieNameMatch &&
                    analysis.TicketPersistenceMatch &&
                    analysis.TicketIssueDateMatch &&
                    analysis.TicketUsernameMatch &&
                    analysis.TicketVersionMatch &&
                    analysis.TicketHashMatch &&
                    (!enforceHostAddressValidation || analysis.HostAddressMatch);
                if (!analysis.IsValid)
                {
                    analysis.IsMalicious =
                        !analysis.CookieDomainMatch ||
                        !analysis.CookiePathMatch ||
                        !analysis.CookieSecureMatch ||
                        !analysis.CookieNameMatch ||
                        !analysis.TicketPersistenceMatch ||
                        !analysis.TicketIssueDateMatch ||
                        !analysis.TicketUsernameMatch ||
                        !analysis.TicketVersionMatch ||
                        !analysis.TicketHashMatch ||
                        (enforceHostAddressValidation && !analysis.HostAddressMatch);
                }
            }
            else
            {
                analysis.IsValid = false;
                analysis.IsMalicious = false;
            }
            return analysis;
        }
public static UserAuthenticationTicketAnalysis AnalyzeServerAuthenticationTicket ( ContextInformation contextInformation , FormsAuthenticationCookieAnalysis cookieAnalysis , FormsAuthenticationTicketAnalysis ticketAnalysis , UserAuthenticationTicket userAuthenticationTicket , bool enforceHostAddressValidation ) { UserAuthenticationTicketAnalysis analysis = new UserAuthenticationTicketAnalysis ( ) ; HttpCookie formsAuthCookie = cookieAnalysis . FormsAuthenticationCookie ; FormsAuthenticationTicket formsAuthTicket = ticketAnalysis . FormsAuthenticationTicket ; analysis . TicketExists = ( userAuthenticationTicket != null ) ; if ( analysis . TicketExists ) { analysis . UserAuthenticationTicket = userAuthenticationTicket ; if ( userAuthenticationTicket != null ) { analysis . CookieDomainMatch = ( userAuthenticationTicket . CookieDomain == formsAuthCookie . Domain ) ; analysis . CookiePathMatch = ( userAuthenticationTicket . CookiePath == formsAuthTicket . CookiePath && formsAuthTicket . CookiePath == formsAuthCookie . Path ) ; analysis . CookieSecureMatch = ( userAuthenticationTicket . CookieSecure == formsAuthCookie . Secure ) ; analysis . CookieNameMatch = ( userAuthenticationTicket . CookieName == formsAuthCookie . Name ) ; analysis . TicketPersistenceMatch = ( userAuthenticationTicket . TicketIsPersistent == formsAuthTicket . IsPersistent ) ; analysis . TicketIssueDateMatch = ( DateTime . Compare ( userAuthenticationTicket . TicketIssueDate , formsAuthTicket . IssueDate ) == 0 ) ; analysis . TicketUsernameMatch = ( userAuthenticationTicket . Username == formsAuthTicket . Name ) ; analysis . TicketVersionMatch = ( userAuthenticationTicket . TicketVersion == formsAuthTicket . Version ) ; analysis . TicketHashMatch = ( userAuthenticationTicket . TicketHash == ticketAnalysis . TicketHash ) ; analysis . HostAddressMatch = ( userAuthenticationTicket . HostAddress == contextInformation . HostAddress ) ; } analysis . IsValid = analysis . CookieDomainMatch && analysis . CookiePathMatch && analysis . CookieSecureMatch && analysis . CookieNameMatch && analysis . TicketPersistenceMatch && analysis . TicketIssueDateMatch && analysis . TicketUsernameMatch && analysis . TicketVersionMatch && analysis . TicketHashMatch && ( ! enforceHostAddressValidation || analysis . HostAddressMatch ) ; if ( ! analysis . IsValid ) { analysis . IsMalicious = ! analysis . CookieDomainMatch || ! analysis . CookiePathMatch || ! analysis . CookieSecureMatch || ! analysis . CookieNameMatch || ! analysis . TicketPersistenceMatch || ! analysis . TicketIssueDateMatch || ! analysis . TicketUsernameMatch || ! analysis . TicketVersionMatch || ! analysis . TicketHashMatch || ( enforceHostAddressValidation && ! analysis . HostAddressMatch ) ; } } else { analysis . IsValid = false ; analysis . IsMalicious = false ; } return analysis ; }
Perform analysis of the UserAuthenticationTicket supplied
Perform analysis of the UserAuthenticationTicket supplied
/* analysis.ExpirationMatch = (DateTime.Compare(UserAuthenticationTicket.TicketExpiration, formsAuthTicket.Expiration) == 0 && DateTime.Compare(formsAuthTicket.Expiration, formsAuthCookie.Expires) == 0); */ /* analysis.ExpirationMatch && */ /* !analysis.ExpirationMatch ||  */
A UserAuthenticationTicketAnalysis object containing the results of the analysis
A UserAuthenticationTicketAnalysis object containing the results of the analysis
contextInformation
ContextInformation
Context information derived from the current request
Context information derived from the current request
cookieAnalysis
FormsAuthenticationCookieAnalysis
The result of the FormsAuthenticationCookie analysis
The result of the FormsAuthenticationCookie analysis
ticketAnalysis
FormsAuthenticationTicketAnalysis
The result of the FormsAuthenticationTicket analysis
The result of the FormsAuthenticationTicket analysis
userAuthenticationTicket
UserAuthenticationTicket
The UserAuthenticationTicket to inspect
The UserAuthenticationTicket to inspect
enforceHostAddressValidation
bool
Indicates whether to enforce that the ticket was provided from the same IP address for which it created
Indicates whether to enforce that the ticket was provided from the same IP address for which it created