Kévin Chalet • 8/8/2018

Session fixation vulnerability in the Auth0 ASP.NET and OWIN SDKs

This technical article details the discovery of a session fixation vulnerability in Auth0's ASP.NET 4.x and OWIN/Katana SDKs, which is a form of CSRF attack. It explains the security flaw, how it can be exploited to force a victim to log into an attacker's account, and references the OAuth 2.0 threat model. The post notes Auth0's awareness and their recommended migration to Microsoft's secure OpenID Connect middleware, including a guide for developers.

0 comments

#Aspnet #OAUTH 20 #Openid Connect