Re: SSL How-TO

From: Joe Kaplan \(MVP - ADSI\) (joseph.e.kaplan_at_removethis.accenture.com)
Date: 06/21/05 

Date: Tue, 21 Jun 2005 11:19:23 -0500

Yes, but if they sniff the cookie they can still replay it and assume your
identity on the website. You generally want to be careful about passing
around forms auth cookies on an unencrypted channel.

Joe K.

<dl> wrote in message news:ex4li0mdFHA.3712@TK2MSFTNGP09.phx.gbl...
>I thought the content of the authentication cookie is an encrypted session
> ticket, with no username / password information, isn't it?
>
> "Dominick Baier [DevelopMentor]" <dbaier@pleasepleasenospamdevelop.com>
> wrote in message news:501385632549583320741864@news.microsoft.com...
>> Hello dl,
>>
>> i guess you are using FormsAuth - so authentication is based on a cookie.
>> This cookie has to be transmitted to every pages that requires
> authentication.
>>
>> This would mean that you secure the login page, but all remaining pages
> will
>> receive the cookie in clear text. If someone can steal/sniff that cookie
>> he can hijack the authenticated users identity.
>>
>> or short - No.
>>
>> ---------------------------------------
>> Dominick Baier - DevelopMentor
>> http://www.leastprivilege.com
>>
>> > Hi
>> > Can we set SSL enable only for the login page, in an ASP.NET
>> > application
>> > TIA
>>
>>
>>
>
>

Relevant Pages

  • RE: Forms authentication cookie handling question (C#)
    ... I also replaced all of my ticket authentication code with the ... // Username and or password not found in our database... ... LoginControl's default code logic to generate authentication cookie. ...
    (microsoft.public.dotnet.framework.aspnet)
  • RE: Forms Authentication
    ... The DNS entry for my domain was not set corrretly, ... This should have overcome the cookie ... authentication ticketis not correctly set to the domain your ... Microsoft MSDN Online Support Lead ...
    (microsoft.public.dotnet.framework.aspnet)
  • RE: Forms authentication cookie handling question (C#)
    ... programmatically generate forms authentication ticket and set it in ASP.NET ... You use the Login control's "Authentication" event to do the user ... LoginControl's default code logic to generate authentication cookie. ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: authentication cookie vs session cookie
    ... level of using authentication cookies on the client machines. ... authentication cookie on a manager's machine is stolen and used on a client ... > session variables as it relies on the session cookie that ASP.NET sends to ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • RE: forms authentication cookie problem
    ... authentication cookie. ... what's going on on the server. ... >324488 Forms Authentication and View State Fail ... >characters, the browser will still request the page, but ...
    (microsoft.public.dotnet.framework.aspnet.security)