asp.net web api - OWIN - clear invalid WSFederation cookies -

i implemented asp.net web api 2 project adfs cookie authentication , hosted on iis. works fine.

however, clients have got old cookies became invalid because of configuration changes. such cookies cause following error when calling api:

[cryptographicexception: key not valid use in specified state. ]    system.security.cryptography.protecteddata.unprotect(byte[] encrypteddata, byte[] optionalentropy, dataprotectionscope scope) +447    system.identitymodel.protecteddatacookietransform.decode(byte[] encoded) +49  [invalidoperationexception: id1073: cryptographicexception occurred when attempting decrypt cookie using protecteddata api (see inner exception details). if using iis 7.5, due loaduserprofile setting on application pool being set false. ]    system.identitymodel.protecteddatacookietransform.decode(byte[] encoded) +329    system.identitymodel.tokens.sessionsecuritytokenhandler.applytransforms(byte[] cookie, boolean outbound) +167    system.identitymodel.tokens.sessionsecuritytokenhandler.readtoken(xmlreader reader, securitytokenresolver tokenresolver) +826    system.identitymodel.tokens.sessionsecuritytokenhandler.readtoken(byte[] token, securitytokenresolver tokenresolver) +92    system.identitymodel.services.sessionauthenticationmodule.readsessiontokenfromcookie(byte[] sessioncookie) +569    system.identitymodel.services.sessionauthenticationmodule.tryreadsessiontokenfromcookie(sessionsecuritytoken& sessiontoken) +306    system.identitymodel.services.sessionauthenticationmodule.onauthenticaterequest(object sender, eventargs eventargs) +159    system.web.synceventexecutionstep.system.web.httpapplication.iexecutionstep.execute() +142    system.web.httpapplication.executestep(iexecutionstep step, boolean& completedsynchronously) +92 

the obvious workaround clear cookies. however, it's i'll change cookies configuration again in future, i'd clear invalid cookies automatically api.

i've tried adding custom owin middleware , overriding iexceptionhandler.

here's wif config:

<system.identitymodel>   <identityconfiguration>     <audienceuris>       <add value="https://my.web-api.com" />     </audienceuris>     <issuernameregistry type="system.identitymodel.tokens.validatingissuernameregistry, system.identitymodel.tokens.validatingissuernameregistry">       <authority name="adfs">         <keys>           <add thumbprint="--a thumbprint--" />         </keys>         <validissuers>           <add name="http://my.adfs.com/adfs/services/trust" />         </validissuers>       </authority>     </issuernameregistry>   </identityconfiguration> </system.identitymodel> <system.identitymodel.services>   <federationconfiguration>     <wsfederation issuer="https://my.adfs.com/adfs/ls" realm="https://my.web-api.com" requirehttps="true" passiveredirectenabled="false"                   persistentcookiesonpassiveredirects="true" />     <cookiehandler name="my.cookie" path="/" persistentsessionlifetime="7.0:0:0" />     <servicecertificate>       <certificatereference x509findtype="findbysubjectname" findvalue="my.web-api.com" storelocation="localmachine" storename="my" />     </servicecertificate>   </federationconfiguration> </system.identitymodel.services> 

here's startup class:

public class startup {     public void configuration(iappbuilder appbuilder)     {         var config = new httpconfiguration();          config.services.replace(typeof(iexceptionhandler), new cryptographicexceptionhandler());         webapiconfig.register(config);         appbuilder.usewebapi(config);         appbuilder.use<clearinvalidcookiesmiddleware>();     } } 

no matter what's inside cryptographicexceptionhandler , clearinvalidcookiesmiddleware, code not called , i'm getting 500 error. tried move clearinvalidcookiesmiddleware before usewebapi.

my aim add set-cookie response header clear invalid cookies , return 401 or redirect.

how can make owin customize response in case?

the solution appeared override sessionauthenticationmodule.onauthenticaterequest , call signout() in case of exceptions:

class clearinvalidcookiessessionauthenticationmodule : sessionauthenticationmodule {     protected override void onauthenticaterequest(object sender, eventargs eventargs)     {         try         {             base.onauthenticaterequest(sender, eventargs);         }         catch(invalidoperationexception ex) when (ex.innerexception cryptographicexception) // invalid cookie signing key         {             signout();         }         catch(system.xml.xmlexception) // invalid cookie structure         {             signout();         }     } } 

to use inherited class instead of default one, 1 should insert following line inside web.config:

<system.webserver>   <modules ...>     <!-- insert line below or replace existing sessionauthenticationmodule -->     <add name="sessionauthenticationmodule" precondition="managedhandler"          type="mynamespace.clearinvalidcookiessessionauthenticationmodule, myassembly" />     ...   </modules> ... </system.webserver>