appharbor/AppHarbor.Web.Security — pull request #16 by gomifromparis (2014-03-23 22:18:15+00:00)
Title: Adding a cookie validation interface to block disabled accounts

One thing I thought of was that if you disable the user account in the user repository, the user will still be authentified by the http module. And if the user has a persistent cookie, he can keep on having it refreshed and never expired, and keep on being logged even with a disabled account.

Same thing if the user changes his password. Any cookie on other browsers will still be valid, even if the password that was used to validate them has changed.
.
So I added a ICookieValidation interface, that allows the user repository to verify the cookie, i.e check the user account is not disabled , and if cookie date is > last password change date.

Injection of depedencies on an http module (loaded before the application_start) can be tricky, but http://haacked.com/archive/2011/06/03/dependency-injection-with-asp-net-httpmodules.aspx/ worked.