Re: Cookieless Sessions (Sessions Without Cookies) and Security

You always have to use SSL if you care about the data on the wire!

If someone can sniff your connection (no SSL) - there is no difference between cookies and cookieless security-wise.

Cookie-less have different (additional) problems:

- session fixation (someone sends you a link with a pre-generated session)
- user copy&paste session URL and send them e.g. via mail
- id is visible in browser (screenshots etc.)

---
Dominick Baier, DevelopMentor
http://www.leastprivilege.com

Thanks for the quick reply.

Some suggest that SSL is the cure all for cookieless sessions. I did
not want to due this initially, but if will allow the secure use of
cookieless sessions, it may be the only option. What are your
thoughts? Does SSL close the security gaps opened by cookieless
sessions, or at least make them as secure as sessions with cookies?

Here is another thought: are sessions with cookies really that much
more secure than cookieless sessions? If someone knows how to obtain
your URL from a remote location, that same person can probably spoof
your cookie.



.

Relevant Pages

  • Re: Major security issue?
    ... that make your car an insecure product? ... There is, real sessions, although that is arguable as well. ... > problematic since ASP first came about. ... Cookieless sessions are just an alternative. ...
    (microsoft.public.dotnet.framework.aspnet)
  • Using useuri with security: Keep returning to login page
    ... I've tried turning off cookies in FireFox and turning on cookieless ... sessions in the forms element inside the authentication element (I set ... the cookieless attribute to UseUri). ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Going sessionless (and cookie limitations)
    ... The sticky sessions will ensure the same web user reaches the same ... server in the web farm so the reconnect with the same session. ... Most decent load balancer hardware supports sticky sessions. ... cookieless mode, I learned it is best to avoid it whenever possible. ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Role-based authentication and Forms and System.UnauthorizedAccessException
    ... yes - you can now do cookieless forms authentication, ... sessions, the authentication ticket gets mangled in the URL. ... >> Hello wrecker, ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: SSL
    ... Going from SSL to normal page seems to keep all the ... sessions... ... the https:// page posts to an http:// page. ...
    (microsoft.public.inetserver.iis.security)