Re: Security and cookieless sessions

From: Nick (Nick@Bluefield.com.hk)
Date: 10/25/02 

From: "Nick" <Nick@Bluefield.com.hk>
Date: Fri, 25 Oct 2002 10:16:01 +0800

Stefan,

Thanks for your speedy reply.

We will be using SSL for encryption. I was just wondering if using
cookieless sessions was inhrently less secure than using session via
cookies.

I want to use the cookieless option as it's more flexible but I don't want
to comprimize security.

I assume you can also spoof a session that uses cookies. Is it much harder
or is the diffeerence so small they can be deamed the same?

Thanks

Nick

Relevant Pages

  • RE: Session not set.
    ... If so, it will never work properly, as the session cookie is never set. ... Checking Sessionfor login is an ASP model, ... If you TRULY want cookieless (setting session vars is not ... the Framework to handle your authentication needs, ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: How to do forms authentication with cookieless=UseUri?
    ... you are confusing session and authentication. ... forms authentication create a login ticket and stores it in a cookie or the ... this is because cookieless changes the url to have a login ticket. ...
    (microsoft.public.dotnet.framework.aspnet)
  • RE: Security and cookieless sessions
    ... Cookieless sessions are designed to support certain protocols which don’t ... for personal reasons turn cookie persistence off in their browsers. ... surreptiously while the session was active, they could use it to spoof the ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Session ID in Query Parameter?
    ... So when posting from such normal html page the session state will ... the ASP.NET buildin cookieless session support does ... It uses the Session object and I really don't want to ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Major security issue?
    ... We have used cookieless sessions and what you say is true, ... client/server (ie. if connection broken, then the SSL session is invalid) so ... > would add some overhead to IIS because every HTTP request ...
    (microsoft.public.dotnet.framework.aspnet)