Sholo.Web.Security/EnhancedSecurityModule.cs
/// <summary>
/// Detects the creation of a FormsAuthenticationCookie and FormsAuthenticationTicket
/// during the processing of the current request (i.e., PostBack of Login page/action),
/// records the state of both in a UserAuthenticationTicket, and adds it to the 
/// Provider.
/// 
/// In the event that this request was already authenticated, it detects and handles 
/// sliding expiration on the Provider.
/// </summary>
/// <param name="sender">The HttpApplication that sent the request</param>
/// <param name="e">Not used</param>
Detects the creation of a FormsAuthenticationCookie and FormsAuthenticationTicket
during the processing of the current request ,
records the state of both in a UserAuthenticationTicket, and adds it to the
Provider.

In the event that this request was already authenticated, it detects and handles
sliding expiration on the Provider.
Detects the creation of a FormsAuthenticationCookie and FormsAuthenticationTicket during the processing of the current request records the state of both in a UserAuthenticationTicket and adds it to the Provider . In the event that this request was already authenticated it detects and handles sliding expiration on the Provider .
private static void OnEndRequest(object sender, EventArgs e)
        {
            FormsAuthenticationStatus status = EnhancedSecurity.GetFormsAuthStatus();
            HttpContext context = HttpContext.Current;
            HttpRequest request = context.Request;
            HttpResponse response = context.Response;
            if (status == FormsAuthenticationStatus.NotFound || status == FormsAuthenticationStatus.Invalid)
            {
                RequestAnalysis preAnalyzer = RequestAnalyzer.RetrieveAnalysis(RequestLifecyclePhase.BeginRequest);
                RequestAnalysis postAnalyzer = RequestAnalyzer.AnalyzeRequest(response.Cookies[FormsAuthentication.FormsCookieName], RequestLifecyclePhase.EndRequest, true);
                if (preAnalyzer != null)
                {
                    ComparisonResult result = RequestAnalyzer.Compare(preAnalyzer, postAnalyzer);
                    if (result == ComparisonResult.UnauthenticatedRequest)
                    {
                    }
                    else if (result == ComparisonResult.AuthenticatedRequest)
                    {
                    }
                    else if (result == ComparisonResult.LoginRequest)
                    {
                        string hash = UserAuthentication.CalculateFormsAuthTicketHash(postAnalyzer.FormsAuthenticationTicket);
                        string key = Guid.NewGuid().ToString();
                        UserAuthenticationTicket serverAuthTicket = new UserAuthenticationTicket
                        {
                            Key = key,
                            Username = postAnalyzer.FormsAuthenticationTicket.Name,
                            HostAddress = request.UserHostAddress,
                            CookieDomain = postAnalyzer.FormsAuthenticationCookie.Domain,
                            CookiePath = postAnalyzer.FormsAuthenticationCookie.Path,
                            CookieSecure = postAnalyzer.FormsAuthenticationCookie.Secure,
                            TicketExpiration = postAnalyzer.FormsAuthenticationTicket.Expiration,
                            CookieName = postAnalyzer.FormsAuthenticationCookie.Name,
                            TicketIsPersistent = postAnalyzer.FormsAuthenticationTicket.IsPersistent,
                            TicketIssueDate = postAnalyzer.FormsAuthenticationTicket.IssueDate,
                            TicketUserData = postAnalyzer.FormsAuthenticationTicket.UserData,
                            TicketVersion = postAnalyzer.FormsAuthenticationTicket.Version,
                            TicketHash = hash
                        };
                        UserAuthentication.Provider.InsertTicket(serverAuthTicket, postAnalyzer.FormsAuthenticationTicket.Expiration);
                        FormsAuthenticationTicket newFormsAuthTicket = UserAuthentication.CreateFormsAuthTicket(
                            postAnalyzer.FormsAuthenticationTicket.Name,
                            postAnalyzer.FormsAuthenticationCookie.Path,
                            hash + ";" + key,
                            postAnalyzer.FormsAuthenticationTicket.IssueDate,
                            postAnalyzer.FormsAuthenticationTicket.Expiration,
                            false
                        );
                        UserAuthentication.ClearAuthCookie();
                        UserAuthentication.SetAuthCookie(newFormsAuthTicket, true, true);
                    }
                    else if (result == ComparisonResult.LogoutRequest)
                    {
                        if (preAnalyzer.UserAuthenticationTicket != null)
                        {
                            UserAuthentication.Provider.RevokeTicket(preAnalyzer.UserAuthenticationTicket.Key);
                        }
                        UserAuthentication.ClearAuthCookie();
                    }
                    else if (result == ComparisonResult.MaliciousRequest)
                    {
                        UserAuthentication.ClearAuthCookie();
                    }
                }
            }
            else if (status == FormsAuthenticationStatus.Valid)
            {
            }
        }
private static void OnEndRequest ( object sender , EventArgs e ) { FormsAuthenticationStatus status = EnhancedSecurity . GetFormsAuthStatus ( ) ; HttpContext context = HttpContext . Current ; HttpRequest request = context . Request ; HttpResponse response = context . Response ; if ( status == FormsAuthenticationStatus . NotFound || status == FormsAuthenticationStatus . Invalid ) { RequestAnalysis preAnalyzer = RequestAnalyzer . RetrieveAnalysis ( RequestLifecyclePhase . BeginRequest ) ; RequestAnalysis postAnalyzer = RequestAnalyzer . AnalyzeRequest ( response . Cookies [ FormsAuthentication . FormsCookieName ] , RequestLifecyclePhase . EndRequest , true ) ; if ( preAnalyzer != null ) { ComparisonResult result = RequestAnalyzer . Compare ( preAnalyzer , postAnalyzer ) ; if ( result == ComparisonResult . UnauthenticatedRequest ) { } else if ( result == ComparisonResult . AuthenticatedRequest ) { } else if ( result == ComparisonResult . LoginRequest ) { string hash = UserAuthentication . CalculateFormsAuthTicketHash ( postAnalyzer . FormsAuthenticationTicket ) ; string key = Guid . NewGuid ( ) . ToString ( ) ; UserAuthenticationTicket serverAuthTicket = new UserAuthenticationTicket { Key = key , Username = postAnalyzer . FormsAuthenticationTicket . Name , HostAddress = request . UserHostAddress , CookieDomain = postAnalyzer . FormsAuthenticationCookie . Domain , CookiePath = postAnalyzer . FormsAuthenticationCookie . Path , CookieSecure = postAnalyzer . FormsAuthenticationCookie . Secure , TicketExpiration = postAnalyzer . FormsAuthenticationTicket . Expiration , CookieName = postAnalyzer . FormsAuthenticationCookie . Name , TicketIsPersistent = postAnalyzer . FormsAuthenticationTicket . IsPersistent , TicketIssueDate = postAnalyzer . FormsAuthenticationTicket . IssueDate , TicketUserData = postAnalyzer . FormsAuthenticationTicket . UserData , TicketVersion = postAnalyzer . FormsAuthenticationTicket . Version , TicketHash = hash } ; UserAuthentication . Provider . InsertTicket ( serverAuthTicket , postAnalyzer . FormsAuthenticationTicket . Expiration ) ; FormsAuthenticationTicket newFormsAuthTicket = UserAuthentication . CreateFormsAuthTicket ( postAnalyzer . FormsAuthenticationTicket . Name , postAnalyzer . FormsAuthenticationCookie . Path , hash + " " + key , postAnalyzer . FormsAuthenticationTicket . IssueDate , postAnalyzer . FormsAuthenticationTicket . Expiration , false ) ; UserAuthentication . ClearAuthCookie ( ) ; UserAuthentication . SetAuthCookie ( newFormsAuthTicket , true , true ) ; } else if ( result == ComparisonResult . LogoutRequest ) { if ( preAnalyzer . UserAuthenticationTicket != null ) { UserAuthentication . Provider . RevokeTicket ( preAnalyzer . UserAuthenticationTicket . Key ) ; } UserAuthentication . ClearAuthCookie ( ) ; } else if ( result == ComparisonResult . MaliciousRequest ) { UserAuthentication . ClearAuthCookie ( ) ; } } } else if ( status == FormsAuthenticationStatus . Valid ) { } }
Detects the creation of a FormsAuthenticationCookie and FormsAuthenticationTicket
during the processing of the current request (i.e., PostBack of Login page/action),
records the state of both in a UserAuthenticationTicket, and adds it to the
Provider.
Detects the creation of a FormsAuthenticationCookie and FormsAuthenticationTicket during the processing of the current request ( i . e . PostBack of Login page / action ) records the state of both in a UserAuthenticationTicket and adds it to the Provider .
// EnhancedSecurity.InterceptFormsAuthenticationCookie(); /* TODO: Remove this once working */ /*
            if (request.RawUrl.Contains("WebResource.axd"))
            {
                return;
            }
            */ // Nothing to do    // Nothing to do    // Store the ticket on the server // Revoke the ticket on the server // Hmm.. what to do // System.Diagnostics.Debugger.Break(); // TODO: Handle sliding ticket expiration // UserAuthentication.Provider.UpdateTicketExpiration();
sender
object
The HttpApplication that sent the request
The HttpApplication that sent the request
e
EventArgs
None