Re: "secure" flag for HttpCookies

Hi, 

no - i cannot confirm - at least in 2.0

this is part of the source of SetAuthCookie:

 if (!context1.Request.IsSecureConnection && FormsAuthentication.RequireSSL)
     {
           throw new HttpException(SR.GetString("Connection_not_secure_creating_secure_cookie"));
     }


haven't checked for 1.1, though


---------------------------------------
Dominick Baier - DevelopMentor
http://www.leastprivilege.com

Dominick,

I checked up on this and confirmed that the issue exists with
FormsAuthentication.SetAuthCookie as well.  Even when requireSSL is
set to true in web.config.  The initial "set-cookie" header sent from
the server to the client can be sent over HTTP.  It just dictates that
the client will not send the cookie to the server on all requests.
But this doesn't matter cause an attacker can just sniff the cookie on
the initial "set-cookie" header from the server.

jas

"Dominick Baier [DevelopMentor]" wrote:

hi,

i mean when requireSSL is set to true.

---------------------------------------
Dominick Baier - DevelopMentor
http://www.leastprivilege.com

Hi,

this is at least an inconsistency -

FormsAuthentication.SetAuthCookie enforces SSL when setting the auth
ticket.

---------------------------------------
Dominick Baier - DevelopMentor
http://www.leastprivilege.com



.

Relevant Pages

  • Re: Issues With User Control Embedded Into Web Page Since Installing .NET 2.0
    ... Dominick Baier - DevelopMentor ... I deployed the same test project to another 2003 server in the same ... - The issues stated above are reproducable from any client, ...
    (microsoft.public.dotnet.security)
  • Re: Securing static files
    ... Dominick Baier - DevelopMentor ... they are kicked back to the login page. ... The user may log in with other credentials. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: How to determine if the logged on user is in a group
    ... Dominick Baier - DevelopMentor ... I found that you to reboot the SERVER after you create a new group and put users in it so that the new group and the users appear in the whoami list on the server. ... although he is a member of these groups. ...
    (microsoft.public.dotnet.security)
  • Re: HOWTO: Prevent Dynamic Loading of internal Types
    ... Dominick Baier - DevelopMentor ... Henning Krause ... I could get the public key from the entry assembly via ...
    (microsoft.public.dotnet.security)
  • Re: How to call Web Service Securely
    ... which .net version - which type of authentication (username/password against a db??) ... Dominick Baier - DevelopMentor ... make a web method via dialup to my IIS Web Service. ...
    (microsoft.public.dotnet.framework.aspnet.security)