Microsoft Security Advisory: iOS12 breaks social, WSFed and OIDC logins

[blowdart]

Microsoft Security Advisory: iOS12 breaks social, WSFed and OIDC logins

Executive summary

Microsoft is releasing this security advisory to provide information about an incompatibly between iOS12 and some types of authentication. This advisory also provides guidance on what developers can do to remove current security restrictions added by ASP.NET to their applications to become compatible with iOS12.

Discussion

Discussion for this issue can be found at https://github.com/aspnet/Identity/issues/1984 for ASP.NET Core Identity
Discussion for this issue can be found at https://github.com/aspnet/Security/issues/1864 for ASP.NET Core Cookie Authentication

Advisory FAQ

What has changed

The recent iOS12 update has changed Safari's handling of SameSite cookies. The SameSite attribute allows a developer to control when cookies are sent to a web site, enabling the flow to only occur when requests are from the same site. This standard was introduced to reduce exposure to Cross Site Request Forgery (CSRF) attacks. By default ASP.NET Core 2.0 and later protects its authentication cookies using the SameSite property. The change on Apple's part is not limited to ASP.NET Core applications, it is affecting multiple frameworks and authentication software which relay on HTTP forms in a browser, for example authenticating to a third party via Facebook, Twitter or browser based Open ID Connect (OIDC) mechanism.

Apple have stated they believe their change is correct behavior, and that the fault lies in every other browser's implementation.

While we take no stance on the correctness of browser behavior we feel that removing the SameSite protections would expose our customers, and their customers to a wider risk, as it would remove the protection provided everywhere, for all users, in any browser.

How do I know if I am affected?

If your users can no longer login to your web application on iOS12 using Safari then you are affected.

How do I fix this?

Developers can allow iOS12 Safari users to log into their applications by turn off SameSite protection in ConfigureServices().

If you are using ASP.NET Core Identity you disable the protection by configuring cookies with the following code

services.ConfigureExternalCookie(options =>
{
    // Other options
    options.Cookie.SameSite = SameSiteMode.None;
});
services.ConfigureApplicationCookie(options =>
{
    // Other options
    options.Cookie.SameSite = SameSiteMode.None;
});

If you are using cookie authentication without ASP.NET Core identity you can turn off the protection with the following code

services.AddCookie(CookieAuthenticationDefaults.AuthenticationScheme, options =>
{
    // Other options
    options.Cookie.SameSite = Microsoft.AspNetCore.Http.SameSiteMode.None;
})

If you are using external OIDC providers you may be able to avoid the issue by changing the response mode your provider uses from a POST to a GET request, using the following code. Not all providers may support this.

.AddOpenIdConnect("myOIDProvider", options => {
    // Other options
    options.ResponseType = "code";
    options.ResponseMode = "query";
};

_Note that in making these changes protection is removed for all users and all browsers. You should ensure that all your actions that make state changes are protected with CSRF anti-forgery mechanisms built into ASP.NET Core.

Rebuilding your application

After making these configuration changes you rebuild your application, test, and redeploy.

Other Information

Reporting Security Issues

If you have found a potential security issue in .NET Core, please email details to secure@microsoft.com. Reports may qualify for the .NET Core Bug Bounty. Details of the .NET Core Bug Bounty including terms and conditions are at https://aka.ms/corebounty.

Support

You can ask questions about this issue on GitHub in the .NET Core or ASP.NET Core organizations. These are located at https://github.com/dotnet/ and https://github.com/aspnet/. The Announcements repo for each product (https://github.com/dotnet/Announcements and https://github.com/aspnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the discussion issue.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

External Links

Bug 188165 - iOS 12 Safari breaks ASP.NET Core 2.1 OIDC authentication

Revisions

V1.0 (September 28, 2018): Advisory published.