Question

我已经能够将DefaultTokenReplayCache子类化并使其在我的MVC应用程序中工作。这正确地检测了由Fiddler从IDP重放到RP的标记，或者按下后退箭头并重新提交。

我现在的意图是在FedAuth cookie存在时阻止缓存重播，并且该会话已经退出。

例如：

DefaultTokenReplayCache正确确定何时重播此响应：

POST http://127.0.0.1:2600/Account/SignIn HTTP/1.1
Accept: application/x-ms-application, image/jpeg, application/xaml+xml, image/gif, image/pjpeg, application/x-ms-xbap, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Accept-Language: en-US
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E; MS-RTC EA 2)
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Connection: Keep-Alive
Content-Length: 6679
Host: 127.0.0.1:2600
Pragma: no-cache

wa=wsignin1.0&wresult=%3Ct%3ARequest .....

但是，如果我退出，则可以重播以下会话

GET http://127.0.0.1:2600/ HTTP/1.1
Accept: application/x-ms-application, image/jpeg, application/xaml+xml, image/gif, image/pjpeg, application/x-ms-xbap, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Accept-Language: en-US
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E; MS-RTC EA 2)
Accept-Encoding: gzip, deflate
Connection: Keep-Alive
Host: 127.0.0.1:2600
Pragma: no-cache
Cookie: FedAuth=77u/PD94bWwgd......

问题

如果该会话退出后，我如何确保WIF不再允许特定的FedAuth cookie？

Answer 1

你是如何退出的？您通常需要调用 FederatedAuthentication.WSFederationAuthenticationModule.SignOut

将清除所有FedAuth cookie。请注意，这不会清除您在应用中设置的任何其他Cookie。

Answer 2

您需要将tokenReplayDetection添加到依赖方的identityConfiguration元素中。

<system.identityModel>
    <identityConfiguration ...>
        <tokenReplayDetection enabled="true"/>
        ...

-Atli

即使在WIF中实现DefaultTokenReplayCache之后，令牌重放仍然可行

2 个答案: