Re: How to use SSL for login page only

Thanks for the link.

So if I inteperet this article correctly, the setting in Web.Config declares
that anytime an authentication COOKIE is sent, it is encrypted, correct?

Does this force the entire page to be SSL Encrypted since it's in
Web.Config, that would make the entire web encrypted, correct?

I get why constantly encrypting the cookie is important because you don't
want it exploited if someone captures it with a malicious script or something.

You mentioned being able to partition the site into secured and unsecured
pages. maybe this is truly what I need to do. Is there an example of how to
do this? Is it just creating a new folder in the site and somehow marking
that folder that it always requires SSL and then putting allo f the sensitive
pages in the encrypted folder while keeping the public folders in the 'main'
web?

Thanks for your help

"Joe Kaplan" wrote:

Setting requireSSL to True in the web.config for the forms authentication
section will take care of the Secure flag. I'd check out the additional
MSDN docs and articles on Forms auth to get more details. Here is one
starting place:

http://msdn2.microsoft.com/en-us/library/1d3t3c61.aspx

Joe K.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"
http://www.directoryprogramming.net
--
"Cory J. Laidlaw, Beyond01.com"
<CoryJLaidlawBeyond01com@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:83DD9E6C-1081-42C9-A151-AA3CC7A1D9B1@xxxxxxxxxxxxxxxx
hey Joe,

Thanks for the advice. Do you know where I might see an example of how to
set this tag?

Thanks!

Cory

"Joe Kaplan" wrote:

That may be ok too, as long as EVERY request to the server that needs to
be
secure goes though SSL. If you just secure the login page, that likely
isn't enough. If you see a site doing that, I would not use it. I
especially would not give them your credit card. :)

You can partition your site into secure and unsecure areas. You can also
set flags on your forms auth cookie to tell the browser to only send it
on
an SSL connection (called the "Secure" flag). That is an important
detail
to remember. I'd also set the HttpOnly flag on the cookie while you are
at
it, as that helps prevent against a variety of cross site scripting
attacks.

Joe K.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services
Programming"
http://www.directoryprogramming.net
--
"Cory J. Laidlaw, Beyond01.com"
<CoryJLaidlawBeyond01com@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:461D1794-3DD5-4122-8DD5-CBC36E1D15D5@xxxxxxxxxxxxxxxx
Joe,

thanks for responding. I see your point.

I just notice that several websites only employ SSL at certain periods,
say
when providing credit card information. Once completed, they turn SSL
off
again.

Cory

"Joe Kaplan" wrote:

Why would you put only the login page under SSL? What makes you think
that
provides any security? Sure, you can encrypt the connection when the
user
is providing their plaintext password, but if someone snoops on a
different
request that isn't encrypted and steals the user's cookie (just as
easy
as
stealing the pwd from the form post), they own the user just the same.
It
begs the question as to why bothering with SSL at all.

Joe K.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services
Programming"
http://www.directoryprogramming.net
--
"Cory J. Laidlaw, Beyond01.com"
<CoryJLaidlawBeyond01com@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:D2CD56D2-634F-4BAF-BB82-9A565C7A1C90@xxxxxxxxxxxxxxxx
Hi there,

I need to setup a web site that starts with a public home page.

I would then like to have a link to a login page so I can
authenticate
them
against a database.

When I launch my project, it starts under HTTP, which is great. How
can
I
make sure the Login page is under HTTPS?

Thanks for any help you can provide!

Cory









.

Relevant Pages

  • Re: tcp/routing question...
    ... SSL operates at a higher level in the TCP/IP protocol stack. ... > be more concrete, SSL is an application-level protocol, whereas IPSec ... you are encrypting between computers. ...
    (Fedora)
  • RE: .NET Form Client Connection to .Net Web Service via SSL
    ... > If you are using SSL with a 128-bit Server Certificate, ... > Anyway, if your URL is 'HTTPS', it is being encrypting, for sure. ...
    (microsoft.public.dotnet.framework.aspnet.webservices)
  • Re: Does My Auto Login Strategy Make Sense?
    ... If the cookie is stolen, the attacker will be able to log. ... I'm planning on encrypting the password and ... Because the TextMode is Password, I can't figure out a way ... I'd like to just assign the stored password to the field. ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Login Encryption; Login Lookup
    ... I was supposing that if you are going to protect customer ... you might as well be encrypting all their information that ... the appropriate way is to enable SSL on the site. ... Without SSL, you may lose many customers, no matter how good ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Email encription
    ... Thanks Mark, very useful info. Think I will reconsider the SSL option. ... > need data that is so important that it needs encrypting. ...
    (uk.net.web.authoring)