Re: Major ASP.Net Security Issue?
From: Ray at <%=sLocation%> [MVP] (%=sLocation%)
Date: 02/01/04
- Next message: Keith: "Using ASPNET_SETREG.exe"
- Previous message: Keith: "Forms-based authentication expires before timeout"
- In reply to: Keith: "Major ASP.Net Security Issue?"
- Next in thread: Paul Glavich: "Re: Major ASP.Net Security Issue?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Sun, 1 Feb 2004 00:00:38 -0500
It seems to me that this would be listed as a predictable downside to using
cookieless sessions. Verifying IPs and/or user agents wouldn't be any real
way to avoid this, so it makes sense to me that this wouldn't be the default
behavior for asp.net to check that. And if it were to check it, where would
it store this info? In session variables? Hmmph.
-- Ray at home Microsoft ASP MVP "Keith" <keith@keithadler.com> wrote in message news:77b601c3e87d$1c5144f0$a101280a@phx.gbl... > I have found what I believe to be a serious security > issue in ASP.Net. If you have: > > 1. Your website configured for anonymous access > 2. Elect under web.config to set the sessionstate > attribute of cookieless to true > > Anyone from any IP address or across another browser can > copy the URL and work within the session. My question > is "Why doesn't ASP.Net provide an option around ensuring > all requests for a user session originate from the same > IP address and/or same useragent?" I know that some > people sit behind firewalls, proxies and layer 4 devices > that could load balance and affect HTTP traffic, but it > honestly escapes me why I can access my web application > on any machine inside or outside of my network with just > the sessionid in the URL from even different browsers. > There must be a way to control this in the > configuration. Am I alone in find this troubling?
- Next message: Keith: "Using ASPNET_SETREG.exe"
- Previous message: Keith: "Forms-based authentication expires before timeout"
- In reply to: Keith: "Major ASP.Net Security Issue?"
- Next in thread: Paul Glavich: "Re: Major ASP.Net Security Issue?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
