Re: Question about cookie protection and FormsAuthentication.Encrypt

You only need to call Encrypt if you are manually creating the FormsAuthenticationTicket and adding it to the cookies collection.

If you are using FormsAuthentication.SetAuthCookie or RedirectFromLoginPage this is done automatically for you (according to config settings).


-----
Dominick Baier (http://www.leastprivilege.com)

Developing More Secure Microsoft ASP.NET 2.0 Applications (http://www.microsoft.com/mspress/books/9989.asp)

I'm a little unclear on when exactly I would need to use
FormsAuthentication.Encrypt. If I have the cookie protection in the
web.config set to All (i.e. <forms loginUrl="login.aspx"
protection="All">), shouldn't my cookie already be encrypted and
tamper-proof even if I don't encrypt the authentication ticket using
FormsAuthentication.Encrypt? What do I gain by also using
FormsAuthentication.Encrypt in addition to the the web.config setting?
Or is this more of a double-check than anything else?



.

Relevant Pages

  • Re: Dynamically load web.config and policyCache.xml
    ... I wouldn't see a reason why you would encrypt debug='false' or WSE settings. ... If you are looking to make the app settings tamperproof, ... > is there anyway to dynamically load web.config and policyCache.xml? ...
    (microsoft.public.dotnet.framework.webservices.enhancements)
  • Re: [SLE] Encryption question
    ... torsdag 04 mars 2004 04:03 skrev C Hamel: ... > settings both in KGpg & kmail and they seem to be identical. ... You haven't, so my kmail just says: "No open key, to verify signature". ... You're probably using his "private" key to encrypt, ...
    (SuSE)
  • protection="None" not working...
    ... cookies still appears to be encrypted. ... When using these settings I have assumed that the ... I assume that the .Encrypt ... is to simply be able to create a string that the .Decrypt method will be ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • RE: How do I fix "no certificates that can be use" message on outl
    ... I'm not too sure how the settings ... > unless you have a digital signature/encryption certificate, ... >> " Microsoft outlook could not sign or encrypt this message becuase you have ...
    (microsoft.public.outlook.installation)