23

We use ASP.NET Identity in a Web Api project with SimpleAuthorizationServerProvider, we use OAuth-tokens to authorize each request coming from the client. (Tokens have and expire timespan, we don't use refresh tokens.)

When users change their password, I would like to invalidate the tokens they may have, possibly on other devices. Is there any way to explicitly do that? I experimented and saw that the existing tokens work without any problem after a password change, which should be prevented.

I thought about putting the password hash, or part of the hash in the OAuth token as a claim, and validating that in the OnAuthorization method of our derived AuthorizeAttribute filter.
Would this be a correct way to solve the problem?

3
  • Isn't part of the point with OAuth that it is independent upon Password changes? Why not just remove the token from your Authentication server when they change the password then if they try and use it on other devices it wont work. Nov 6, 2014 at 10:04
  • "Why not just remove the token from your Authentication server": is this possible with ASP.NET Identity? I thought that tokens are self-contained, so they can be used on any web-server instance, thus we don't have an Authentication server. Nov 6, 2014 at 10:23
  • If that's true then it sounds like I need a refresher on "ASP.NET Identity" its been a while. Sorry. Nov 6, 2014 at 10:37

2 Answers 2

17

I've based my approach on Taiseer's suggestion. The gist of the solution is the following. Every time a user changes their password (and when registers), a new GUID is generated and saved in the database in the User table. I call this GUID the password stamp, and store it in a property called LatestPasswordStamp.

This stamp has to be sent down to the client as part of the token as a claim. This can be achieved with the following code in the GrantResourceOwnerCredentials method of the OAuthAuthorizationServerProvider-implementation.

identity.AddClaim( new Claim( "PasswordTokenClaim", user.LatestPasswordStamp.ToString() ) );

This stamp is going to be sent from the client to the server in every request, and it is verified that the stamp has not been changed in the database. If it was, it means that the user changed their password, possibly from another device. The verification is done in our custom authorization filter like this.

public class AuthorizeAndCheckStampAttribute : AuthorizeAttribute
{
    public override void OnAuthorization( HttpActionContext actionContext )
    {
        var claimsIdentity = actionContext.RequestContext.Principal.Identity as ClaimsIdentity;
        if( claimsIdentity == null )
        {
            this.HandleUnauthorizedRequest( actionContext );
        }

        // Check if the password has been changed. If it was, this token should be not accepted any more.
        // We generate a GUID stamp upon registration and every password change, and put it in every token issued.
        var passwordTokenClaim = claimsIdentity.Claims.FirstOrDefault( c => c.Type == "PasswordTokenClaim" );

        if( passwordTokenClaim == null )
        {
            // There was no stamp in the token.
            this.HandleUnauthorizedRequest( actionContext );
        }
        else
        {
            MyContext ctx = (MyContext)System.Web.Mvc.DependencyResolver.Current.GetService( typeof( MyContext ) );

            var userName = claimsIdentity.Claims.First( c => c.Type == ClaimTypes.Name ).Value;

            if( ctx.Users.First( u => u.UserName == userName ).LatestPasswordStamp.ToString() != passwordTokenClaim.Value )
            {
                // The stamp has been changed in the DB.
                this.HandleUnauthorizedRequest( actionContext );
            }
        }

        base.OnAuthorization( actionContext );
    }
}

This way the client gets an authorization error if it tries to authorize itself with a token which was issued before the password has been changed.

6
  • 2
    Nice solution, Is there no official way which OAuth suggests we handle such cases? I mean it seems to be a serious hole in the whole authentication scheme if all devices can still access once the password has been changed. Apr 9, 2015 at 8:35
  • 1
    Yeah, I think the issue here is that OAuth itself does not know anything about where the identities come from, that's the responsibility of the identity provider. For instance here ASP.NET Identity, and the built-in OAuth handler facilities are separate and don't know about each other, that's why we have to manually let the token handler know that the password was changed. Apr 9, 2015 at 9:10
  • Would my proposed solution below work according to your experience? stackoverflow.com/questions/29534111/… Apr 9, 2015 at 9:12
  • Thanks for taking the time to post the details on the solution that worked for you!
    – webworm
    Apr 20, 2016 at 16:49
  • 1
    A simpler solution along the same lines would be to check the token issued date against the password last changed date (stored in the database). That would save having to generate and store and pass around the GUID.
    – paulH
    Aug 26, 2016 at 10:31
14

I do not recommend putting the hash of the password as claim, and I believe there is no direct way to invalidate token when password is changed.

But if you are Ok with hitting the DB with each request send from the client app to a protected API end point, then you need to store Token Identifier (Guid maybe) for each token granted to the resource owner requested it. Then you assign the token Identifier as a custom claim for this token, after this you need to check this table with each request by looking for the token identifier and the user name for the resource owner.

Once the password is changed you delete this token identifier record for this resource owner (user) and the next time the token sent from the client it will get rejected because the record for this token identifier and resource owner has been deleted.

4
  • 1
    This was simple to implement and works properly. Thanks! Nov 11, 2014 at 15:35
  • 2
    Glad it was helpful. If you would like why you do not share part of the code you created to implement this, I'm sure it will be useful for others :) Nov 12, 2014 at 10:41
  • @TaiseerJoudeh In the above question let's say the scenario is same however instead of changing password user try to login on three different device and I want only that token should work on which User has logged recently and the previous two token of other two device should be revoked/delete. Is there any way to achieve so? Jul 12, 2016 at 8:02
  • damn I can't believe I am reading this. MS has done another dung
    – Toolkit
    Nov 16, 2018 at 20:20

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.