Handle auth schemes in cookie names

[Tratcher]

Description

#23579 removed cookie name encoding due to security concerns outlined in #23578. The result is that people creating cookies need to provide valid names. #25266 identified a scenario where the ASP.NET authentication libraries generate cookie names using a secondary value without ensuring it makes a valid cookie name. The two affected scenarios are remote authentication and cookie authentication.

The downlevel patches (#24264) used a more conservative mitigation that does not introduce the same regression. We opted not to use the same fix in 5.0 because it has known limitations.

Fix

In the remote authentication scenario the authentication scheme name can be removed from the correlation cookie, it's not providing any value there.

In the cookie auth scenario the authentication scheme is used to distinguish between cookie instances. We'll encode only the authentication scheme in the cookie name to ensure it makes a valid cookie name. Limiting the encoding to the auth scheme name avoids the concerns in the original security issue.

Customer Impact

Regression?

Yes, in preview 8 as a side effect of a security change #23579

Risk

Low

cc: @martincostello

[Pilchie]

Approved for RC1.

[Tratcher]

/azp run

[azure-pipelines]

Azure Pipelines successfully started running 2 pipeline(s).

[Tratcher]

/azp run

[azure-pipelines]

Azure Pipelines successfully started running 2 pipeline(s).

[Tratcher]

Merge please.