What is ASP.NET Identity's IUserSecurityStampStore<TUser> interface?

Question

Looking at ASP.NET Identity (new membership implementation in ASP.NET), I came across this interface when implementing my own UserStore:

//Microsoft.AspNet.Identity.Core.dll

namespace Microsoft.AspNet.Identity
{ 
    public interface IUserSecurityStampStore<TUser> :
    {
        // Methods
        Task<string> GetSecurityStampAsync(TUser user);
        Task SetSecurityStampAsync(TUser user, string stamp);
    }
}

IUserSecurityStampStore is implemented by the default EntityFramework.UserStore<TUser> which essentially get and set the TUser.SecurityStamp property.

After some more digging, it appears that a SecurityStamp is a Guid that is newly generated at key points in the UserManager (for example, changing passwords).

I can't really decipher much beyond this since I'm examining this code in Reflector. Almost all the symbol and async information has been optimized out.

Also, Google hasn't been much help.

Questions are:

• What is a SecurityStamp in ASP.NET Identity and what is it used for?
• Does the SecurityStamp play any role when authentication cookies are created?
• Are there any security ramifications or precautions that need to be taken with this? For example, don't send this value downstream to clients?

---

Update (9/16/2014)

Source code available here:

• https://github.com/aspnet/Identity/
• https://github.com/aspnet/Security/

Sociology

@TryingToImprove, the new Identity store and dependant OWIN middleware is designed to be highly customizable. Like SimpleMembership, there is an out-of-the-box implementation leveraging the latest EF on SQL Express. But the Schema, Data querying method, Database source, and even middle ware are customizable around your specific puprose. What's more, the implementation released by MS is itself still evolving. That's why everyone struggles to find a specific definition. – Consol

Answer 1

This is meant to represent the current snapshot of your user's credentials. So if nothing changes, the stamp will stay the same. But if the user's password is changed, or a login is removed (unlink your google/fb account), the stamp will change. This is needed for things like automatically signing users/rejecting old cookies when this occurs, which is a feature that's coming in 2.0.

Identity is not open source yet, its currently in the pipeline still.

Edit: Updated for 2.0.0. So the primary purpose of the SecurityStamp is to enable sign out everywhere. The basic idea is that whenever something security related is changed on the user, like a password, it is a good idea to automatically invalidate any existing sign in cookies, so if your password/account was previously compromised, the attacker no longer has access.

In 2.0.0 we added the following configuration to hook the OnValidateIdentity method in the CookieMiddleware to look at the SecurityStamp and reject cookies when it has changed. It also automatically refreshes the user's claims from the database every refreshInterval if the stamp is unchanged (which takes care of things like changing roles etc)

app.UseCookieAuthentication(new CookieAuthenticationOptions {
    AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
    LoginPath = new PathString("/Account/Login"),
    Provider = new CookieAuthenticationProvider {
        // Enables the application to validate the security stamp when the user logs in.
        // This is a security feature which is used when you change a password or add an external login to your account.  
        OnValidateIdentity = SecurityStampValidator.OnValidateIdentity<ApplicationUserManager, ApplicationUser>(
            validateInterval: TimeSpan.FromMinutes(30),
            regenerateIdentity: (manager, user) => user.GenerateUserIdentityAsync(manager))
    }
});

If your app wants to trigger this behavior explicitly, it can call:

UserManager.UpdateSecurityStampAsync(userId);

Aegisthus

What if I am migrating data from MVC4 table structure? Can I just leave that field blank? Or is it going to screw things up somehow? – Offshoot

You can just have it return the ID or something constant to effectively make it a no-op. Null/"" would probably work as well. – Aegisthus

Does the UserManager.UpdateSecurityStampAsync(userId) work for UseOAuthBearerTokens? – Weightless

No, OAuthBearerTokens are not affected currently. – Aegisthus

If I call UserManager.UpdateSecurityStampAsync(userId); on each login, will that solve a problem like this one – Inge

Hey guys, it doesn't work for me. Nothing happens even if I change the password in a different browser, or I change the role of the user from a different browser. – Muriel

I just hit this issue when saving an entity to the database. In my particular case I am inserting a parent entity that has a child object of IdentityUser,so I am not using the UserManager to save the entity. I noticed that the AspNetUsers record in the database had a null value in the SecurityStamp field. I believe I can pass a GUID to this property, but how do I do that when not using the UserManager? – Townsville

Is it safe for me to use the security stamp to invalidate tokens in my Token Provider class? If the security stamp does not match that means the password has changed and the user has to login again? – Evangelical

The UseCookieAuthentication is deprecated by now. I managed to configure it using services.Configure<SecurityStampValidatorOptions>(o => o.ValidationInterval = TimeSpan.FromSeconds(10));. – Rosenberry

@Rosenberry please move comment to answer since this is right answer these days. Your comment is hidden by so app, and after 3th time reading I fund right solution to logguser by UpdateSecurityStampAsync – Sixfold

Answer 2

The UseCookieAuthentication is deprecated by now. I managed to configure it using

services.Configure<SecurityStampValidatorOptions>(o => 
    o.ValidationInterval = TimeSpan.FromSeconds(10));

Moved from reply to answer per request.

Rosenberry

Does this work if I am using ASP.NET (not Core)? I am confused. If I go to the Asp Identity Repo, it say it's for Asp.NET Core. – Butlery

Answer 3

I observed the SecurityStamp to be required for token verification.

To repo: Set SecurityStamp to null in the databsae Generate a token (works ok) Verify token (fails)

Halfslip

That's got to be a bug. It makes no sense to generate a token that cannot be verified. – Mathamathe

The bug is that it lets you generate a token when the security stamp is blank. (imho GenerateEmailConfirmationToken should fail if there is no security stamp. See this answer: https://mcmap.net/q/128275/-asp-net-identity-2-giving-quot-invalid-token-quot-error) – Aesthetic