Please respect HttpOnly / Secure options in SignOut cookie

[i4rilu]

AspNetKatana/src/Microsoft.Owin/Infrastructure/ChunkingCookieManager.cs

Line 276 in e2b18ec

new CookieOptions

AspNetKatana/src/Microsoft.Owin/Infrastructure/ChunkingCookieManager.cs

Line 289 in e2b18ec

new CookieOptions

Please respect HttpOnly / Secure options when constructing SignOut cookie.

new CookieOptions
{
   Path = options.Path,
   Domain = options.Domain,
   Expires = new DateTime(1970, 1, 1, 0, 0, 0, DateTimeKind.Utc),
   HttpOnly = options.HttpOnly,
   Secure = options.Secure,
});

[Tratcher]

These options do not apply to signout cookies, the cookie is being deleted. Was this affecting a real client or was it only flagged by some automation?

[i4rilu]

This was flagged during the compliance scanning.
If options do not apply to signout cookie - it would be great to have more control on signout cookie in ChunkingCookieManager.
Current approach is just to copy-paste whole DeleteCookie() method.
Thank you!

[jesperkristensen]

I have changed my authentication cookie name to have the __Host- prefix to ensure cookie integrity. Now the cookie is not deleted when SignOut() is called.

The following response header is sent, but the browser ignores it because it is missing the Secure flag:
Set-Cookie: __Host-.AspNet.Cookies=; path=/; expires=Thu, 01-Jan-1970 00:00:00 GMT

(Tested in latest Firefox and Chrome)

[jesperkristensen]

I found this workaround:

        app.UseCookieAuthentication(new CookieAuthenticationOptions
        {
            CookieName = "__Host-.AspNet.Cookies",
            CookieManager = new FixedCookieManager(),
        });


public class FixedCookieManager : ChunkingCookieManager, ICookieManager
{
    public new void DeleteCookie(IOwinContext context, string key, CookieOptions options)
    {
        options.Expires = new DateTime(1970, 1, 1, 0, 0, 0, DateTimeKind.Utc);
        AppendResponseCookie(context, key, "", options);
    }
}