Skip to main content

A few things on Session you should know

I got to read a good article explaining the nuances of cookie less sessions which prompted me to note down a few important things. Here is the link to post that started me on this.

To simply enable cookie less session do this -

<sessionState cookieless="true" />

What this will do is that your URL’s start looking like -

http://mysite.com/(22b5c4zyybphaw2mt3hjni2n)/Home.aspx

This is obviously not secure.

However what I want to note here is that even just having cookie based sessions (which is the default setting in .net web applications) is also not secure enough.

So did a bit of binging and found out fairly quickly that best thing to do is obviously setup the whole web site on an SSL. (pretty obvious that one).

However what if there are some pages that are outside the ssl. There is one confusing or very near and related setting in the forms element of the authentication tag that might fool someone which says setup forms element for authentication with requireSSL attribute as true. Now the problem with this is that it does not secure your Session Id cookie. Session Id cookie is generated on the very first hit and transmitted back to client even before your authentication kicks in.

There is another related setting that is called – AspKeepSessionIDSecure. What this does is ensures that Session Id cookie travels only on the https traffic creating another problem of how to handle session id on non ssl pages.

So to secure your session id cookie you go to the global.asax and get into the session start event and simply mark or setup the session id cookie as secure. Here is how you do this -

Request.Cookies("ASP.NET_SessionId").Secure=True

This will mark the session id cookie to be secure.

Some handy resource links on this topic -

http://blogs.msdn.com/b/jaskis/archive/2009/12/23/securing-session-id-asp-asp-net.aspx

http://worldofasp.net/tut/SessionHijack/Securing_Session_In_ASPNET_793.aspx

http://msdn.microsoft.com/en-us/library/1d3t3c61.aspx

Comments

Post a Comment

Popular posts from this blog

Notes on Castle MonoRail

  Sometime back I was doing a small POC on Castle MonoRail. So here are my quick notes on this. MonoRail is an MVC Framework from Castle inspired by ActionPack. MonoRail enforces separation of concerns with Controller handling application flow, models representing data and View taking care of the presentation logic. To work with MonoRail you need Castle Assemblies. It also utilizes nHibernate You can use Castle MonoRail Project Wizard or create the project manually. Project structure – Content Css Images Controllers HomeController.cs Models Views Home \ index.vm Layouts \ Default.vm ...
Post a Comment
Read more

Workflow Foundation 4 - Part 3 - Data storage and management

This is my third post on WF4. First one was an introductory post on WF4 and in second one we focused on executing workflows. In the this post I am going to focus on the topic of data storage and management. Every business process or flow depends on data. When you think of data there are three elements to it as listed below - Variables - for storing data Arguments - for passing data Expressions - for manipulating data. Let us first look at the variables. Variables are storage locations for data. Variables are declared before using them just like in any other languages like C# or VB.Net. Variables are defined with a specific scope. When you create a variable in an activity the scope of the variable becomes that activity's scope. Variables can also have access modifiers like None, Mapped or ReadOnly. Let us look at an example where we will create two variables and assign a scope to them along with access modifiers. //Declare a sequence activitiy Sequence seqWf = new Sequence(); //de...
Post a Comment
Read more

Introduction to Workflow Foundation 4 (WF4)

I finally decided to pick-up my blogging once more. Since I have been trying to learn Windows Workflow Foundation 4 (WF4) I thought I might as well start off with this topic. WF4 is a development framework that enables you to create a workflow and embed it in a .Net application. It is neither an executable application nor a language. It provides a set of tools for declaring a workflow, activities to create your logic and to define control flow and a runtime for executing the resulting application definition. It also provides services for persistence of state, tracking and bookmarking. You can create your workflow directly in code, in mark-up or in a combination of both. Workflow provide us with two major advantages - Creating unified application logic. Making application logic scalable. Workflow Authoring styles - Sequential Workflow executes a set of contained activities in a sequential manner. Workflow Foundation was introduced in the .Net 3.0 and updated in 3.5. In .net 4 it has bee...
Post a Comment
Read more