Re: authentication cookie vs session cookie

From: Michal A. Valasek (news_at_altaircom.net)
Date: 08/08/03 

Date: Fri, 8 Aug 2003 14:10:37 +0200

| What are the differences between authentication and session cookies? In my
| web.config file, I set the cookieless attribute for the sessionState
element
| to false. Why do we need 2 different types of cookies? Is the session
| cookie enough for authentication purpose?

Authentication and session cookies should be different, so you can use these
features independently. Most of my applications uses authentication, but has
disabled session state. Having one solution would force everyone using Forms
Authentication to use sessions too.

| I do feel uncomfortable to maintain 2 different timeouts (form
| authentication cookie and session) in the web.config file. Is it possible
to
| keep both in sync (i.e. make authentication cookie expires at the same
time
| the session expires)?

You can set timeouts for login and session state to same value. 

-- 
Michal A. Valasek, Altair Communications, http://www.altaircom.net
Please do not reply to this e-mail, for contact see http://www.rider.cz

Relevant Pages

  • Re: Fwd: [PHP] Re: a question on session ID and security
    ... I think the difference is that you send one key (a session identifier) ... secondary hash key stored in cookies. ... hash key" to the client when it doesn't need it? ... Use the authentication key to identify the users data, then get the "secondary hash key" from that data. ...
    (php.general)
  • RE: Reconnect to a session and authenticate.
    ... I solved this problem by adding the cookies and doing a server transfer. ... certain session connection or forms authentication connection in your code ... However, for session state, it is always doneby ... Microsoft MSDN Online Support Lead ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Web session tracking security prob. Vulnerable: IIS and ColdF usion (maybe others)
    ... Web session tracking security prob. ... upload Netscape-style cookies on http://cookies.lcs.mit.edu/. ... insecure authentication schemes including schemes used at WSJ.com, ...
    (Vuln-Dev)
  • Re: Hiding variables passed via URL
    ... well you can view cookies as well. ... What else constitutes a 'session variable' apart from POST or GET data ... But then you don't understand that session variables aren't POST or GET ... You could coordinate PHP with Javascript. ...
    (comp.lang.php)
  • Re: Framework bug with Auth and Session state?
    ... forms authentication ticket into the cookie as described in Microsoft's book ... > mean that I assume that if the user is Authenticated that the the session ... (I mean I know why it is two different cookies, ...
    (microsoft.public.dotnet.framework.aspnet.security)