Skip to main content

A few things on Session you should know

I got to read a good article explaining the nuances of cookie less sessions which prompted me to note down a few important things. Here is the link to post that started me on this.

To simply enable cookie less session do this -

<sessionState cookieless="true" />

What this will do is that your URL’s start looking like -

http://mysite.com/(22b5c4zyybphaw2mt3hjni2n)/Home.aspx

This is obviously not secure.

However what I want to note here is that even just having cookie based sessions (which is the default setting in .net web applications) is also not secure enough.

So did a bit of binging and found out fairly quickly that best thing to do is obviously setup the whole web site on an SSL. (pretty obvious that one).

However what if there are some pages that are outside the ssl. There is one confusing or very near and related setting in the forms element of the authentication tag that might fool someone which says setup forms element for authentication with requireSSL attribute as true. Now the problem with this is that it does not secure your Session Id cookie. Session Id cookie is generated on the very first hit and transmitted back to client even before your authentication kicks in.

There is another related setting that is called – AspKeepSessionIDSecure. What this does is ensures that Session Id cookie travels only on the https traffic creating another problem of how to handle session id on non ssl pages.

So to secure your session id cookie you go to the global.asax and get into the session start event and simply mark or setup the session id cookie as secure. Here is how you do this -

Request.Cookies("ASP.NET_SessionId").Secure=True

This will mark the session id cookie to be secure.

Some handy resource links on this topic -

http://blogs.msdn.com/b/jaskis/archive/2009/12/23/securing-session-id-asp-asp-net.aspx

http://worldofasp.net/tut/SessionHijack/Securing_Session_In_ASPNET_793.aspx

http://msdn.microsoft.com/en-us/library/1d3t3c61.aspx

Comments

Post a Comment

Popular posts from this blog

Health Framework - Apple vs Android

In the past few years we have seen mobile and its apps rise and shine transforming many industries in its wake. However, the growth in health and fitness category has been less spectacular at 49% compared to overall mobile app industry which grew at 115% in the year 2013 (source Flurry Analytics). A few years ago Microsoft and Google attempted to make inroads into the health and fitness sector by bringing web based products to store and maintain health and fitness information like MS HealthVault and Google Health with not so spectacular results. Next came innovations by Fitbit in the wearables sector for activity tracking, in 2011 and 2012 they introduced first wireless activity trackers to sync using Bluetooth. This was followed by the entry of Jawbone into health sector with its announcements of Up wristband and accompanying app. These have had better success resulting in many startups joining the wearables product bandwagon.  Late to the stage almos...
Post a Comment
Read more

Quick notes on Git

  I have been away from writing anything for a long time and instead have been fooling around with other stuffs like just plain reading, growing mustache, trying to learn swimming, trying to learn to play acoustic guitar and trying my hands at photography. To be honest I have not given up on them yet but neither have I been able to hang on to them in a disciplined manner. So here I am back to my writing after a long gap. This time its going to be quick notes on Git . Git is a file repository. As opposed to other repositories like SVN Git thinks of its data more like a snapshot of a mini filesystem. All operations in Git are local. (Entire history of the project is stored locally in your working directory) Browsing project history. Viewing all changes to a file. Git uses Checksum to track repository items Everything in Git is check-summed It uses SHA-1 hash for generating check sum values All a...
2 comments
Read more

Notes on Multi-Threading

1. System.Threading namespace provides classes and interfaces that enable multithreaded programming. 2. How to initiate new Thread?     a. Create an object of a Thread class        i. Argument should not be null        ii. Should have permission to create thread.        b. Its constructor takes an instance of a ThreadStart Class     c. ThreadStart Class requires the method that needs to be run on new thread.     d. Call the Start method of the thread class to initiate execution on this new thread. 3. Important points on Threading –     a. Thread function can be static or non-static     b. You can have multiple threads with same thread function.     c. You should always assign a name to the thread using its Name property. (This was pointed out to me by Kalyan Krishna. He said it invaluable...
2 comments
Read more