如何更改OpenID Connect中间件（nonce和相关）cookie的默认名称

Question

我使用两个ASP.NET Core中间件进行OpenID Connect和cookie身份验证，如下所示：

app.UseCookieAuthentication(new CookieAuthenticationOptions
{
    AuthenticationScheme = "cookie",
    CookieName = "clientcookiename",
    CookieHttpOnly = true,
    CookieSecure = _hostingEnvironment.IsDevelopment() ? CookieSecurePolicy.SameAsRequest : CookieSecurePolicy.Always,
    AutomaticAuthenticate = true,
    AutomaticChallenge = false,
    ExpireTimeSpan = TimeSpan.FromMinutes(60)
});

var oidcOptions = new OpenIdConnectOptions
{
    AuthenticationScheme = "oidc",
    SignInScheme = "cookie",                
    ...
};
app.UseOpenIdConnectAuthentication(oidcOptions);

在Web应用程序中登录时，会产生一些与nonce和correlation相关的默认cookie，如下所示（从我的浏览器开发人员工具中导出）：

{
    "domain": "localhost",
    "expirationDate": 1478762475.872038,
    "hostOnly": true,
    "httpOnly": true,
    "name": ".AspNetCore.OpenIdConnect.Nonce.CfDJ...ihRRfQid0Rw",
    "path": "/",
    "sameSite": "no_restriction",
    "secure": false,
    "session": false,
    "storeId": "0",
    "value": "N",
    "id": 1
  },
  {
    "domain": "localhost",
    "expirationDate": 1478762474.872093,
    "hostOnly": true,
    "httpOnly": true,
    "name": ".AspNetCore.Correlation.oidc.Apx...XlCFhuc...Hcq8",
    "path": "/",
    "sameSite": "no_restriction",
    "secure": false,
    "session": false,
    "storeId": "0",
    "value": "N",
    "id": 2
  }

1. 这些cookie的责任是什么？
2. 我们如何更改这些Cookie的CookieName？
3. 更改这些Cookie的CookieName会在其他地方产生任何后果吗？

Answer 1

  

这些cookie有什么责任？

相关和随机数cookie分别用于防止XSRF /会话固定攻击和重放攻击。它们是OpenID Connect中间件使用的安全检查的重要组成部分。

  

我们如何更改这些Cookie的CookieName？

你做不到。在这两种情况下，cookie名称都是不可配置的（它以硬编码部分为前缀）。

相关代码可在此处找到：

• 相关Cookie：https://github.com/aspnet/Security/blob/dev/src/Microsoft.AspNetCore.Authentication/RemoteAuthenticationHandler.cs#L198

• Nonce cookie：https://github.com/aspnet/Security/blob/dev/src/Microsoft.AspNetCore.Authentication.OpenIdConnect/OpenIdConnectHandler.cs#L896

Answer 2

仅设置Cookie名称不适用于Asp.Net Core 2.0。我还必须设置其他属性：

return this.value.length < 8 && (event.keyCode >= 65 && event.keyCode <= 90 || event.keyCode >= 97 && event.keyCode <= 122 || event.keyCode >= 48 && event.keyCode <= 57)

Answer 3

这是implemented

oidcOptions.NonceCookie = new CookieBuilder() { Name = "TheNonceCookieName" };