Any opinions expressed here are my own and not necessarily those of my employer (I'm self-employed).

Mar 2, 2012

How to enable WIF token replay detection

Windows Identity Foundation (WIF) is vulnerable to replay of security tokens in its default configuration. The "Replay Detection" article on MSDN presents a good example of how things can go wrong without the replay detection (why do everyone have to use online banking as their example?):
As another example, suppose that a user opens a browser on a public kiosk, logs on to a bank account using the bank’s Web site, logs off and leaves, but does not close the browser. The response to the user’s logon page, which contains the STS token, is still in the browser’s history. Another person could then browse back to that response page and replay it, which would repost the STS token to the bank’s Web site.
This scenario is very much real and it does not involve any fancy hacking techniques. All you need is a browser and a "back" button. You'll find some scattered references on the Internet to the solution of the problem, the tokenReplayDetection configuration setting. You'll find a mention of the configuration element in the WIF FAQ on Technet and in the WIF book, but you'll find the most helpful explanation in the ACS security guidelines.

I'll cut to the chase, here's the config to enable the token replay detection. Please don't use the parameters as is, read the security considerations and tweak the values accordingly. Seriously.

    <tokenReplayDetection enabled="true" capacity="1000" expirationPeriod="00:10:00" />

Note that the expirationPeriod attribute expects a TimeSpan. See the TimeSpan.Parse method for examples on how to set the value. You might be surprised to see that e.g. a value of "10" would make it ten days, and not 10 minutes. My example would make it ten minutes.

Security considerations
The replay detection is based on a cache that keeps track of security tokens already seen. The "Replay detection" article explains more about how it works:
This cache does not guarantee that a token can never be replayed. It performs best effort detection based on the size of the cache, the expiry time of the STS token, and the rate of unique authentication requests received by the RP. It is strongly recommended that you tune the cache size and STS token expiry time for your RP to get the right balance between performance and security.
First and foremost, the expirationPeriod must be longer than the period the security tokens are valid. Security tokens should not expire from cache before they have expired themselves. If a token is valid for five minutes, you would want to cache it for at least six minutes. After six minutes it would not be valid anymore, hence it cannot be replayed and can be safely removed from cache.

You need to estimate how many tokens you would need to keep in the cache for the duration of the expirationPeriod. This value is highly dependent on the traffic on your site. You should of course base this estimate on the peak hours of the site and set the capacity attribute accordingly.

Finally, there's the issue of server affinity. Your now fine tuned replay detection cache is not shared between servers. That means that you need to have sticky sessions if you're running a web farm — to ensure that a client keeps hitting the same server. If the user hits a new server, the security token will not be found in the cache.

Verifying replay detection
It's important to verify that the replay detection works. To do that you could log out of your application. Then go back to the page where the security token was submitted and trigger the browser to "resubmit the form." Another approach would be to use a tool such as Fiddler to replay the web request where your security token is posted to WIF. When WIF detects a replayed token it will throw the following exception:
ID1062: Replay has been detected for: Token: 'System.IdentityModel.Tokens.SamlSecurityToken', AssertionId: '_b3f7608b-9c6f-4efc-8300-3e8373f62df3', Issuer: 'Name of STS'. 
Don't assume that replay detection works, verify that a replay triggers the exception!

Remaining security risks
Unfortunately, even if you do everything right, things can still go wrong in the default WIF setup.

  • If a server is removed from cluster, all tokens that are cached on that server (but not expired) can be replayed. They'd hit another server which would accept the token, sign in the user and put the security token in its cache.
  • If the capacity of the cache is exceeded, valid tokens should be expected to be purged from the cache. Hence, they could be replayed to the very same server. So choose the capacity wisely!

You would have to implement your own SecurityTokenCache, backed by e.g. AppFabric or a SQL server, to share the security token cache between servers. Hopefully there will be built-in providers in the not so distant future, now that WIF will be incorporated in the .NET framework.

There, hope that helps!

PS! It seems the configuration might be changing for .NET 4.5 where WIF will be included in the System.IdentityModel namespace. According to the 4.5 documentation, there's no capacity attribute.


  1. Good article! Thank you! Something that I am not clear on is how the replay detection works.

    Does it simply detect the replay of tokens that should have expired already or does it detect a token being replayed from multiple locations?

    I have a scenario where we actually make use of token replay within our system. Client logs on to our system, does some operation. He moves on, close the browser what ever.. The operation gets executed in the back-end and eventually we need to call back into the website where some legacy code that has not yet been ported to the back-end exist. But for the back-end to call into the website and to execute under the same users context we need to replay the token of the requesting user.

    How will token replay affect the scenario above?

  2. ขอบคุณสำหรับการแบ่งปัน

  3. Thank you for such a nice detailed post. I always love to read your site content as these are really helpful for me.

    สมัคร gclub

  4. Thank you! I'm glad to find this article here.

  5. Thank you very much for publishing this kind of article. I like your article a lot. I actually want to share my website details with you please produce some information to increase performance like as your website.

  6. During higher studies in colleges, students often have to prepare multiple documents, quizzes and surprise tests. This is the main reason why most students search for online assignment help Australia over the internet and choose only the most proficient and trusted academic writing experts. Law assignment help Australia in understanding how legal theories and concepts can be enforced in the real world. That is why Australian search engine is filled with the terms such as help essay, assignments in essay, assignment help usa, service companies who deals in essay writing, help essay writing, who can do my essay assignment, help with essay, I am in need essay help, who can help with my essay problem, and many more. Therefore, it is advisable for students to seek professional law assignment helps. Help with Assignment in understanding how legal theories and concepts can be enforced in the real world.

  7. Web Ocean Design is the best IT services provider for complete mobile and web application development. The young development company based in Bihar, India, owned and managed by Vicky who have a good amount of experience in Information Technology, Management and other related fields. We provide technical and creative services ranging from Internet Marketing to Communication maneuver. We are also skilled in website development which includes brand promotion, web designing and software development.

    website design company in patna
    website development company in patna
    website development in patna

    web design company in patna
    web development company in patna
    website design in patna

    website design patna
    seo company in patna
    seo company in bihar

  8. 90minup ข่าวกีฬา ฟุตบอล ผลบอล วิเคราะห์บอล พรีเมียร์ลีก ฟุตบอลไทย

  9. โปรโมชั่นใหม่ “แจกโบนัส สูงสุดทันที 1,000 บาท”
    gclub online โปรโมชั่น แบบครบวงจรที่คอยอัพเดทข่าวสารเกี่ยวกับโปรโมชั่น จีคลับ บาคาร่าออนไลน์ สล็อตออนไลน์ ตลอดทั้ง 24 ชั่วโมง เพื่อให้ท่านได้สามารถเข้าร่วมสนุกไปกับเกมออนไลน์ของเราได้ตลอดเวลาโปรโมชั่นสำหรับสมาชิก Premium, VIP ที่แจกโบนัสให้สูงที่สุด 10% และโปรโมชั่นแบบรายวัน สำหรับคำขอบคุณที่มอบให้กับ โปรโมชั่น gclub

  10. ที่พักเกาะล้าน ที่พักเกาะล้าน เกาะสวยน้ำใสใกล้กรุงเทพแห่งนี้ คือ ที่เที่ยวยอดฮิตของนักท่องเที่ยวจากทั่วทุกสารทิศ
    และแน่นอนว่าบนเกาะล้านแห่งนี้นั้นยังมี ที่พักเกาะล้าน สวยๆ ไว้ให้บริการอีกมากมาย treetep.com

    สมัครใช้งาน Gmail

  11. the desire to change the floors and also the companies that periodically clean the floors but are always exposed to dirt, the company offers the best service in the cleaning of the cleaning companyشركة النجوم لخدمات التنظيف
    شركة تنظيف فلل بجدة
    شركة تنظيف بيوت بجدة
    شركة تنظيف شقق بجدة

  12. You attain full value for the money which you put in to access when you seek who can write my research paper, as well as other types of best writing services from our firm which include dissertations, theses, reviews any different writings.

  13. Companies offering affordable custom research papers should help students perform well by delivering papers prior to deadline. Early delivery of essay writing service nursing is very important because it results in good performance of learners.

  14. Assignment studio.net is the place if you are struggling with your thesis or evaluation paper. We have professional thesis, essay writers to help you with any kind of assignment help.
    For further information queries visit our website thesis writing

  15. Web Ocean Design is the best IT services provider for complete mobile and web application development. The young development company based in Bihar, India, owned and managed by Vicky who have a good amount of experience in Information Technology, Management and other related fields. We provide technical and creative services ranging from Internet Marketing to Communication maneuver. We are also skilled in website development which includes brand promotion, web designing and software development.

    ||best seo company in patna||
    ||digital marketing company in patna||
    ||best website design company in patna l,||

    ||affordable seo service in patna||
    ||website optimization in patna||
    ||educational internet marketing company patna||

    ||social media marketing company patna||
    ||real estate seo company in patna||
    ||ecommerce seo company patna||

  16. Thanks for this valuable information sharing, and i learned a lot and cleared my all doubts in this.. keep posting like this useful information.
    post free classified ads in india

  17. Are you looking to hire the best Custom Research Paper Services? It is tedious and overwhelming crafting Research Paper Assistance Services for learners, Custom Dissertation Writing Service can be basic complex with detailed instructions from the teacher.

  18. Thank you for your excellent article. I feel good about your article.

  19. This article makes life happy, bright and gives good ideas.
    Sa gaming สมัคร


  20. When it comes to your academic dreams and grades we try to give our best by supporting you in completing your college assignments.
    Our administrative experts work dedicatedly and passionately to provide top quality essay writing help to the students. Meticulous paper structures,
    subject matter relevance, free from grammatical errors are main characteristics that our highly experienced and talented writers endeavor for.
    Still drowning in the worry to complete your college assignments?

    Assignment helpers Online


  21. Most of the students are fascinated with opting Law as a career.
    A good academic record leads to a good placement also.
    Unique Submission law assignment writing help services are here to take off the burden of multiple
    assignment writing topics from your shoulders.
    Here our law subject expert writers will ensure to get you peerless outcomes with their
    law assignments help on the comprehensive writing academic field.

    Law assignment writing help

  22. Thanks for posting How to enable WIF token replay detection. I was facing this trouble and worried about accurate information. Your post has helped me a lot . I love to read the security consideration which you have informed in your blog post. Essay Writing Service

  23. Our team of Ethics Essay Writing Services is comprised of professionals who have experience in delivering Ethics Research Writing Services. The company also offers Online Essay Writing Services At affordable cost.

  24. Cleanliness is one of the important things and attention must be paid to the constant cleaning of the place and care in order to have a house free from dust and dirt, as having a completely clean place is one of the things that every housewife seeks for and our company is used
    شركة تنظيف بعنيزة

    شركة تنظيف مجالس بعنيزة

    شركة مكافحة حشرات بعنيزة

    شركة نقل عفش بعنيزة

    شركة كشف تسربات المياه بعنيزة

  25. Thanks for sharing this post.
    Online poker itself has now become a safer alternative to gambling for bettors. You no longer need to worry about your profession being disrupted when playing poker gambling.
    Online Poker India
    How to play poker
    Real Money Poker
    Poker Games Online

  26. We take charge with 24/7 Emergency Alarm response notification you have an option with us to do it yourself or have a monitoring supervisor do it for you. we believe in providing Tailored security as per each individual client.
    Help is only a button press away – all our operators speak with the user directly through the Medical Alert. No landline or installation required – Product arrives ready to use.
    Mobile Medical Alert System enables the user to alert an Emergency wherever, whenever. Automatic Fall Detection features, incase you can't press the button. Magnetic charger and voice activation for the partially sighted and those with dexterity.
    Download our APP for Android & IOS – Suitable for Family members or carers. Receive instant SOS and Fall notifications wherever, whenever. Have full control over your loved one's preferences and talk directly to user through your smartphone to the Medical Alert System. Yoga Yoga 4th July Maharaja Express Fare

  27. It is sleeping to brainwave a no sound Golden State unit equity loan even if the gala is merchant strong, as a lot depends on the territory wherever the haunt is located, and equity deep rooted by the possessor. These hangout assets loans can be nearly new for repairs, home ground improvement, and opposite disconnected costs. The idea these planet assets loans are agreed is thatability at hand is no citation of go.

    Analysts said Ms. Sinema won by careful MK Outlet Online campaigning. While not a fan of Mr. 16, Cheap Michael Kors Handbags 2016" > >SeaWorld Orlando announces Blue Friday dealsDewayne BevilSeaWorld Orlando has added several Coach Outlet Clearance Sale holiday offerings to its Blue Ray Ban Outlet Friday promotion, its take Nike Air Force 1 Cheap Outlet on the Jordan Shoes For Sale Black Friday shopping phenomenon. The deals will be available only online Best Yeezys from midnight Eastern Standard Time on Nov. On Monday, Coach Outlet Online Nov..

  28. เกมส์สล็อตออนไลน์ที่ดีที่สุด goldenslot สามารถเข้าไปร่วมสนุกกันได้ที่ ทางเข้า goldenslot

  29. I don’t usually read blog posts, but I’d like to think this write-up really forced me to try and do it! Your writing style took me by surprise. Thanks, good post, really nice.
    beechtree sale

  30. You need to estimate how many tokens you would need to keep in the cache for the duration of the expirationPeriod. This value is highly dependent on the traffic on your site. You should of course base this estimate on the peak hours of the site and set the capacity attribute accordingly.

  31. This process is an easy but not for new users because they have not enough knowledge about it and I think, they should watch YouTube videos and get good result. Dissertation writing service.

  32. my Instagram followers and I’m sure they’ll enjoy it as well. It’s an amazing lighting idea.I wanna make it your idea.
    I think this amazing lighting idea could be beautified our Christmas Day.fintech software development

  33. Fantastic post! Please keep sharing. I know of a roofing company if you are looking for Gamr Please get in touch! Thanks, have a good day.Game

  34. my Instagram followers and I’m sure they’ll enjoy it as well. It’s an amazing lighting idea. I wanna make it your idea. I think this amazing lighting idea could be beautified our Christmas Day. travel

  35. There is a possibility that the plants will be washed later in the microwave oven, do not use staples, paper clips, or other metal objects. Sometimes additional information is required to provide complete differentiation, as well as special staining techniques.Health

  36. I was researching opinion about User Learning Experiences and Experience Design views but I don't understand where I should go for researching. Sheet mask material

  37. Pro version of GBWhatsapp is also best prevailed official website best for messaging application.

  38. Are you looking for Translation Services Boston? If yes, then Global Translation Help is the ultimate platform where you can get Boston Translation Services at affordable prices. We have native translators who have proficiency in more than 200 languages. We provide online translation help in Boston cities like Worcester, Springfield, Lowell, Cambridge, New Bedford, Brockton, Quincy, and all others.

  39. Beautiful a great post. I fair faltered upon your web journal and needed to say that I have truly delighted in perusing your web journal posts. Monster Truck


  40. Yes i agree with you. I have used this app. Its really very helpful for me. I am very thankful for this. It is such a great design of post, which you have shared. I thumbs up this post. Keep it up!visit this link

  41. This comment has been removed by the author.

  42. I will provide you a lifetime experience, allow me to plan your journey and take care of all the arrangements in Israel, please contact me about different activities in Israel, jeep tours, museums, attractions for kids, Bar Mitzvah ceremony and private tours.gaminglight

  43. Amazing post, I liked the article on this site. I love your way representation.
    Thank you too much and keep.

    Review my webpage - 대구오피

  44. This comment has been removed by the author.

  45. This comment has been removed by the author.

  46. This comment has been removed by the author.

  47. I have read all the comments and suggestions posted by the visitors for this article are very fine,We will wait for your next article so only.Thanks!
    Himalayan Persian Cat

  48. Great, your post is helping me a lot. Thanks for the detailed info on this topic. It’s hard to find nowadays to know about the basics but you did it so much well. I would love to see more about it. Keep sharing and updated. Also share more posts with us. Thank you. FMWhatsapp

  49. I honestly appreciate the blog you have posted. Really looking forward to this kind of words.

  50. I had a similar system error in the mr cooper app when we were doing real estate and lending. I found their contacts at mr cooper and found out how to solve the problem. Perhaps you should also contact the manufacturer.

  51. Osm! This post is very informative and effective. I got what I was looking for. Here to say thank you. Thanks for sharing FMWhatsapp valuable content.

  52. All things considered, winning does not mean you will have the capacity to win back the majority of the misfortunes.crossbow

  53. Thanks for the detailed article on this topic. I would like to see more such awesome articles from you.

  54. Thanks for sharing this valuable piece of information. Keep sharing more such awesome articles in the future. Goodbye!

  55. Excellent blog, I loved it so much that I came back here to give feedback. Thanks though.

  56. Thank you so much for sharing this. Would love to see more of these in the future. Keep up the good work! Keep sharing such awesome stuff.


  57. I hope this post is beneficial for viewers. Many thanks for the shared this informative and interesting post with us.

  58. The information you have shared here is very helpful. I really like and appreciate your work. Thanks again for it, keep us updated in future! Gbwhatsapp is also good?

  59. Thank you so much, this is the best information.

    Visit Us:
    Qlick Here!!

  60. Thanks for this informative blog and for giving us an opportunity to share our views.
    bulk whatsapp sender crack full version
    dolby access bagas31

  61. True that from the history and the back button, we can open the previously opened websites and that's not always proves useful. I like this blog on this important topic.

  62. Hello Dear thanks For Sharing Such A Greate content with Us, Its really an amazing Information so please keep sharing. I also Have something special for you so please check out

    adobe photoshop cs6 crack dll files 32bit 64bit download
    avast anti track premium full
    proshow producer crack
    InPage Download

  63. Thanks for this informative blog and for giving us an opportunity to share our views.
    IDM Crack
    AVS Video Editor Crack
    Syncios Crack

  64. addicted to coke reddit is a hallucinogenic drug. This means that when consumed, it causes the user to have unusual experiences such as hearing sounds, seeing illusions, and feeling things that are not actually there. A drug with an extensive history of both medicinal and recreational use, LSD use does not come without risks. An acid trip can last 12 hours or more, and when it goes wrong it can go terribly wrong. This substance is common at raves, parties, and music festivals, so knowing what acid looks like and understanding the risks is imperative, especially for young adults and teenagers.

  65. The We Level Up FL cbt therapy for addiction emotional wellness community is an exceptionally particular, present day, forward-thinking office giving imaginative conduct recuperation treatment programs. Treatments happen in a serene manicured setting with open air unwinding regions offering restoration spaces. Giving science-based psychological wellness medicines intended for every customer and conveyed through profoundly customized individual consideration.

  66. The alcohol poisoning level stage is the initial phase in treating liquor addiction. Withdrawal indications normally die down inside around one to about fourteen days subsequent to beginning detox; be that as it may, this could take longer relying upon the seriousness of your Alcohol Use Disorder (AUD). From that point, you will actually want to zero in on different parts of the recuperation cycle, like various exercises, treatments, advising meetings, and backing choices.

  67. Thanks For Allowing us to Share Our Views In This Blog. Share PcsCrack With others.

  68. I am very impressed with your post, thanks for sharing. Would love to see more stuff like this in future.

  69. It's great to have you here. I really like the colours and theme.
    Is this your website? I'd like to start working on my project as soon as possible.
    If you don't mind, I was curious to know where you got this or what theme you're using.
    Thank you.
    Adobe InDesign Ios Best Mac software site

  70. Hello, Dear Thanks for sharing such great content with the US it’s really amazing content so please keep sharing. I also have something for you so please check out
    SketchUp Pro Ios Mac Torrent

  71. Hello, Dear Thanks for sharing such great content with the US it’s really amazing content so please keep sharing. I also have something for you so please check out
    Parallel Ios Best Mac software site

  72. that I bookmark your blog and will often come back at some point.
    Also visit my website : 토토

  73. 토토사이트 Completely awesome posting! Bunches of helpful data and motivation, both of which we all need!Relay welcome your work

  74. FMWhatsApp is getting famous because they provide many colorful fantastic themes and much more features like theme changing. I will tell you all about those features in this post.

  75. I totally passionate to visit this blog. Awesome you have written there, it explains everything in a simple way. 200+ Best Free iMac Mockups for 2022

  76. Thank you for nice information. Please visit our web:

    Click Here
    Click Here

  77. I was inspired by images on Pinterest of so many book crafts; one that caught my eye that I knew I would be capable of making was an image of a holiday ornament made from pages of a book.

  78. such an amazing article i really like it. Please share more amazing articles like this

  79. Hi There,
    Very nice information, Thank you for sharing with us such nice info.

  80. I felt extremely upbeat while 안전놀이터

  81. am anticipating perusing new articles. Interesting post. I Have Been wondering about this issue, so thanks for posting. Pretty cool post.It 's really very nice and Useful post.Thanks 오션카지노 주소

  82. d this amazing thing, and I’m sure everyone will appreciate this interesting things. Really impressive post. I read it whole and going to share it with my social circules. I enjoyed your article and planning to rewrite it on my own blog. 사설토토

  83. Wow, happy to see this awesome post. I hope this think help any newbie for their awesome work. Thanks a lot for keeping great stuff. I am very much thankful for this site. 메리트카지노

  84. ternet for entertainment only and happened upon your site. Impressive post. Much obliged a ton for sharing your insight! It is extraordinary to see that a few group actually put in an exertion into dealing with their sites. I'll make certain to return again genuine soon. 슈어맨코드거래

  85. It is a good site post without fail. Not too many people would actually, the way you just did. I am impressed that there is so much information about this subject that has been uncovered and you’ve defeated yourself this time, with so much quality. Good Works! Thank you a bunch for sharing this with all of us you actually realize what you are talking about! Bookmarked. Please also seek advice from my site =). We could have a hyperlink change contract between us! You make so many great points here that I read your article a couple of times. Your views are in accordance with my own for the most part. This is great content for your readers. 피보나치시스템


  86. I am very happy to read this article. Thanks for giving us Amazing info. Fantastic post.
    Thanks For Sharing such an informative article, Im taking your feed also, Thanks.eset nod32 license key

  87. จุดเด่นของ เกมสล็อตทดลองเล่นอย่าง ลึกซึ้ง ทำให้เกมของเรา มีคุณภาพทั้งเรื่อง กราฟิกสีสันของเกม ซึ่งทาง BETFLIX เสนอและสอนวิธีเล่น


  88. Keep doing what you're doing and keep spreading the word. I like your post.
    OmniGraffle Pro

  89. unlimited texting, communication when you use fm whatsapp with best features

  90. Well Said & Your Opinion Was Fabulous!

  91. Thanks i get a lot information from this site

  92. Assignment Help Liverpool is a service that provides academic assistance to students studying in Liverpool, UK. Liverpool is known for its prestigious universities, such as the University of Liverpool, Liverpool John Moores University, and Liverpool Hope University, which attract thousands of students from around the world.
    Assignment Help Liverpool


Copyright notice

© André N. Klingsheim and www.dotnetnoob.com, 2009-2018. Unauthorized use and/or duplication of this material without express and written permission from this blog’s author and/or owner is strictly prohibited. Excerpts and links may be used, provided that full and clear credit is given to André N. Klingsheim and www.dotnetnoob.com with appropriate and specific direction to the original content.

Read other popular posts