Partial login security enhancement

[brockallen]

• Issue GUID for the PartialLoginReturnUrl claim
• Put GUID into cookie (protected)
• Validate GUID in ResumeLoginFromRedirect

[cortex93]

Who will emit the Guid into the cookie ?
Would it be possible to simply remove the returnUrl claim in custom code. You should resume only if no need to redirect. I was thinking about an helper method EndPartialLoginAndRedirect to do that and ease custom code.
This scenario could then enable chained custom partial login ?

[brockallen]

The GUID would be managed by the authentication page. This also allows parallel logins (multiple tabs).

The security problem is that the user could simply type in the well-known URL and bypass your custom web pages.

[brockallen]

This has been fixed on the dev branch.

[cortex93]

Not tested yet but implementation is good for me