Forms Security

From: Matt (matthewr_at_becta.org.uk)
Date: 06/22/05 

Date: Wed, 22 Jun 2005 16:04:53 +0100

Hi I have the MSDN forms security example in my .net code, tweaked to suit
my application.

When I log in, and step through my code, I see everything get created
correctly, and if I look in the cookies folder, the cookie myname@localhost
gets created

But the page then redirects, and the security doesnt see the cookie and so I
end up back at the login page.
What have I missed?
I assume that the .net framework handles the rest, so it looks to me that it
is not finding the correct cookie name in the web.config file

The only thing I have done is encrypted the ticket, so I can see I may need
to add in a function somewhere to decrypt it and check it?

Any advice / help greatfully recieved, as Im goign round and round in
circles

Relevant Pages

  • [REVS] Cross Site Cooking
    ... Get your security news from a reliable source. ... On sites where authentication data is tied on a server to a session ID, ... Let's begin with a quick primer on cookie parsing: ... For security purposes, the browser ...
    (Securiteam)
  • [UNIX] PHPNuke Admin Password Can Be Stolen
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Vulnerabilities in PHPNuke expose the administrative password. ... To successfully exploit this vulnerability you will need to rely on two ... The administrator login/password pair is stored in a cookie like this: ...
    (Securiteam)
  • Re: A technique to mitigate cookie-stealing XSS attacks
    ... I'd like to thank the "Microsoft Internet Explorer Team" for ... I'd like to point out that this security feature does not help ... This new HTTPOnly security feature would simply stop cookie hijacking ... > During the Windows Security Push in Feb/Mar 2002, the Microsoft Internet ...
    (Bugtraq)
  • Re: Forms Authentication w/SubFolders
    ... Please note that this means that applications will now share security. ... >> the fact that this cookie exists, and returns to the login.aspx page. ... > manually setting the encryption key in the webconfig. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • [UNIX] YaBB Security Vulnerabilities (CSS in Login, Insecure Password Handling)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... attacker to steal user's cookies, hijacking user's accounts, and more. ... stealing the username cookie is easy. ...
    (Securiteam)