Ok ASP.NET WebForms is old technology now but we'll be stuck with it for the foreseeable future and I'm just trying to see if I can put in a very basic replay attack prevention mechanism. Basically we want to make sure that after a user has explicitly logged out, nobody can replay an old request and have it be automatically authenticated based on the authorization cookie, but we still want to allow using permanent authorization cookies for users that don't want to re-login each new browser session.
From what I've observed in the latter case if you exit your browser and start a new session, there is *no* session ID in the cookie headers - only the forms authorization cookie. In this case we want to allow automatic authentication (at least for GET requests).
In the "replay" case, there is a session ID in the cookie headers - but ASP.NET actually automatically recreates a new session using the same ID. Fortunately we can detect this (by checking Session.IsNewSession and Request.Headers["Cookie"] - though not, strangely, Request.Cookies which sometimes includes the session cookie even when it wasn't sent by the client), and hence it's possible to force a re-login in the case that the client has sent a session ID for a session that has been closed/abandoned when a user logged out. 

But...if the replay attack deliberately omits the session ID, then there's no real way to distinguish this from a legitimate browser request when the authorization cookie is a permanent cookie. You could at least block "POST" requests in such a case, but a replay attack could just issue a GET first to establish the new session, then follow this with a POST. 
What I *really* want is a way to determine that once a user has logged out, the cookie value that was used to authorise that session is no longer valid - I guess that would require storing something in a DB (most likely a list of currently valid cookie values), which seems like more effort than can be justified at this point. But it also seems that anything else (e.g. using hidden nonce fields on forms) is prone to a script that just emulates a user re-establishing a new session with a permanent authorization cookie, in which case they'd be able to determine the required nonce field values etc. So assuming I'm correct that something has to be stored on the server-side to keep track (essentially) of which authorization cookie values are still valid, are there any known low-footprint/well-known libraries that do this?

(BTW for now I've made use of the IsPersistent flag on the authentication ticket - if this is false, i.e. the user has explicitly chosen to only use a per-session cookie knowing they'll have re-login for their next browser session, then I can reliably block replay attacks. But if true, I only block 'POST' replays, which isn't providing much real protection but at least users that are concerned about more sophisticated replay attacks can prevent them by always choosing per-session authentication).