Probably you don't care if any action can be replayed, e.g. the async requests that probably get some non-vital information.
Still you can require the app to essentially re-login before every important action which has financial or security consequences.
I hope you never exchange the authentication secrets (passwords) via the net. Instead, you send the app a challenge string, the app encodes it using the password and sends back. The server does the same and compares the results. This operation is easy to repeat before any important action, and even as a part of an important action: the reply is sent encoded by the secret. Unless the eavesdropper knows the secret, he's out of luck replaying an action, because the challenge sent by server will be different.
No, I have no idea if this scheme fits well into asp.net authentication mechanisms.
You might try having the client send an encrypted or hash protected sequence number and time-stamp with every transaction, and check for duplicates on the server end.
Aside from using a SSL connection for your application to make sure nobody steals the cookie to begin with, there is no fool-proof way to prevent replay attacks that utilize a stolen authentication cookie.
Your best bet is to set the cookie expiration to something pretty low and require the users re-enter their credentials after that timeout. Ideally, this would be a sliding window, but you could make it an absolute one if you don't mind really ticking off your users.
发布评论
评论（3）
您可能不关心任何操作是否可以重播，例如可能获取一些非重要信息的异步请求。
不过，您仍然可以要求应用程序在执行每一个会带来财务或安全后果的重要操作之前重新登录。
我希望您永远不要通过网络交换身份验证秘密（密码）。相反，您向应用程序发送一个质询字符串，应用程序使用密码对其进行编码并发回。服务器也执行相同的操作并比较结果。此操作很容易在任何重要操作之前重复，甚至可以作为重要操作的一部分：回复是通过秘密编码发送的。除非窃听者知道这个秘密，否则他将无法重播某个操作，因为服务器发送的挑战会有所不同。
不，我不知道这个方案是否适合 asp.net 身份验证机制。
Probably you don't care if any action can be replayed, e.g. the async requests that probably get some non-vital information.
Still you can require the app to essentially re-login before every important action which has financial or security consequences.
I hope you never exchange the authentication secrets (passwords) via the net. Instead, you send the app a challenge string, the app encodes it using the password and sends back. The server does the same and compares the results. This operation is easy to repeat before any important action, and even as a part of an important action: the reply is sent encoded by the secret. Unless the eavesdropper knows the secret, he's out of luck replaying an action, because the challenge sent by server will be different.
No, I have no idea if this scheme fits well into asp.net authentication mechanisms.
您可以尝试让客户端在每个事务中发送加密或哈希保护的序列号和时间戳，并检查服务器端是否有重复项。
You might try having the client send an encrypted or hash protected sequence number and time-stamp with every transaction, and check for duplicates on the server end.
除了为应用程序使用 SSL 连接来确保没有人从一开始就窃取 cookie 之外，没有任何万无一失的方法可以防止利用被盗身份验证 cookie 的重放攻击。
最好的办法是将 cookie 过期设置为相当低的值，并要求用户在超时后重新输入其凭据。理想情况下，这将是一个滑动窗口，但如果您不介意真正激怒用户，则可以将其设为绝对窗口。
Aside from using a SSL connection for your application to make sure nobody steals the cookie to begin with, there is no fool-proof way to prevent replay attacks that utilize a stolen authentication cookie.
Your best bet is to set the cookie expiration to something pretty low and require the users re-enter their credentials after that timeout. Ideally, this would be a sliding window, but you could make it an absolute one if you don't mind really ticking off your users.