title: Asp.Net forms authentication replay attack
body: <p>We are getting hit with a scenario where a user logs off and previous good session cookie ( including sliding time window) is replayed and our code jumps right to the requested page as the user.   We are not maintaining session state in the server.  This Asp.Net forms authentication.</p>
  
  <p>I was thinking that the only solution to this is to add columns to the server to track a users log status.   Not real hard but requires code, db, and deployment to accomplish.</p>
  
  <p>Is this the best way to handle this?  Since we will have to crack into code anyway, we could add client request ip's and other stuff to the cookie.  But the current spoof is to reuse the clients machine as well as the session.</p>
  
  <p>Any thoughts?</p>
  
  <p>Thanks in advance</p>
  
  <p>bille</p>
  
  <p>Javascript code that checks for inactivity -> logout</p>
  
  <p><code>
              $j(document).ready(function () {</p>
  
  <pre><code>            /******************************************************************
              Auto-logout after the user's session times out
              ******************************************************************/
  
              var timeOut = (_TIMEOUT - 5) * 60;
              var setTimeout = function () {
                  $j(".session-timeout").stopTime().oneTime(timeOut + "s", function () {
                      $j(this).show();
                      $j(this).oneTime("300s", function () {
                          window.location = $j(this).find("a.logout").attr("href");
                      });
                  });
              };
              $j(".session-timeout a.refresh-session").click(function () {
                  NextGen.CHS.UtilitiesWebService.RefreshSession(
                      function () {
                          $j(".session-timeout").fadeOut();
                          setTimeout();
                      },
                      function () {
                      }
                  );
              });
  
              setTimeout();
          });
  </code></pre>
  
  <p></code></p>