title: How to track expired WIF fedauth cookies?
body: <p>I have an interesting problem with trying to keep track of expired WIF authentication sessions/cookies.</p>
  
  <p>As a bit of background: the site is MVC 3, uses Windows Identity Foundation (WIF) that has a trust with an ADFS server as an STS. The entire site is protected by SSL. The STS has the token expiry set to 60 minutes.</p>
  
  <p>When a user signs out manually, we just simply call the SignOut method on the FedAuth module:</p>
  
  <pre><code>FederatedAuthentication.WSFederationAuthenticationModule.SignOut(false);
  </code></pre>
  
  <p>This of course removes the FedAuth cookies, but here's where the problem starts. If I capture those cookies with Fiddler, I can re-present them to the site within their expiry time and still be treated as logged in. </p>
  
  <p>I realise that this is being performed from a privileged position of the browser having accepted fiddler as a proxy... but the customer is worried that those auth cookies not actually being expired presents a significant security risk. They're are not convinced that SSL protects the site sufficiently, and that if an attacker could execute an MITM attack, they could use those cookies after the user thinks they have logged out.</p>
  
  <p>I have explained that if they are vulnerable after log out, they are vulnerable during log in, but they don't care...</p>
  
  <p>So I have looked for ways to be sure that once a user logs off, the fedauth cookies associated with that logon session are treated as expired. The WIF handlers don't seem to have a built in mechanism for tracking expired tokens, and I have not found anything else related to this.</p>
  
  <p>I guess that this is in fact a wider problem -> how to detect expired cookies in general? A valid cookie is a valid cookie! </p>
  
  <p>The obvious solution is to track those cookies after logout somehow, but I'd like to avoid the custom code route if possible; as a noob, a lot of the security literature says to avoid custom coding any kind of session mechanics, as you will probably get it wrong!</p>
  
  <p>Is anyone aware of any standard solutions in ASP.NET to this problem?</p>
  
  <p>Thanks in advance.</p>