更改后强制ASP.Net声明验证

Question

I'm developing an ASP.Net application with OWIN and currently I have a problem with claims. I have two levels of application: basic and advanced. Some features are available for advanced users only. So I check claims, and if user doesn't have claim advanced I return 403. But here I found the workaround which ruins this system:

• User activates advanced mode
• He performs any action and save its access token
• He disactivates advanced mode
• Now he's able to perform actions just like he is in advanced mode with this token, however he actually has not permissions to do it.

I'm trying to find some fine solution for this situation but I have no ideas except set 1 minute timeout or always check AspNetUserClaims instead of cookie and so on, but they don't work in my case because he can activate a lifetime feature in this one minute interval and then use it forever.

But i'd like to set some server-side flag like oops, this guy have just changed his cookies, check it from database or something to lower database roundtrips for common API calls.

Is there any standard default way to do it? Or maybe I have just chosen a wrong instrument?

Answer 1

You Need to send update cookies according to your claim value.

Below is code to update your claim value.

Inside your action when user disable/enable advanced mode, Then update user claims .

var isAdvanced= "1";    

var identity = (ClaimsIdentity)User.Identity;

// check if claim exist or not.
var existingClaim = identity.FindFirst("IsAdvanced");
if (existingClaim != null)
    identity.RemoveClaim(existingClaim);

// add/update claim value.
identity.AddClaim(new Claim("IsAdvanced", isAdvanced));

IOwinContext context = Request.GetOwinContext();

var authenticationContext = await context.Authentication.AuthenticateAsync(DefaultAuthenticationTypes.ExternalCookie);

if (authenticationContext != null)
{
    authenticationManager.AuthenticationResponseGrant = new AuthenticationResponseGrant(identity,authenticationContext.Properties);
}

As soon as you will made a redirection, you will get your get updated claim value, hence you don't need to make database round trip.

Credit to this post.

Answer 2

Unfortunly, the only way I found is actually query DB itself and check if user has valid credentials:

public bool HasRequiredClaims(string[] requiredClaims)
{
    using (var context = new ApplicationDbContext())
    {
        int actualNumberOfClaims = context.Users
            .SelectMany(x => x.Claims)
            .Count(c => requiredClaims.Contains(c.ClaimValue)); // claim values are unique per user (in my case) so I don't have to filter on user
        return actualNumberOfClaims == claimsValuesToSearch.Length;
    }
}