Skip to main content

A few things on Session you should know

I got to read a good article explaining the nuances of cookie less sessions which prompted me to note down a few important things. Here is the link to post that started me on this.

To simply enable cookie less session do this -

<sessionState cookieless="true" />

What this will do is that your URL’s start looking like -

http://mysite.com/(22b5c4zyybphaw2mt3hjni2n)/Home.aspx

This is obviously not secure.

However what I want to note here is that even just having cookie based sessions (which is the default setting in .net web applications) is also not secure enough.

So did a bit of binging and found out fairly quickly that best thing to do is obviously setup the whole web site on an SSL. (pretty obvious that one).

However what if there are some pages that are outside the ssl. There is one confusing or very near and related setting in the forms element of the authentication tag that might fool someone which says setup forms element for authentication with requireSSL attribute as true. Now the problem with this is that it does not secure your Session Id cookie. Session Id cookie is generated on the very first hit and transmitted back to client even before your authentication kicks in.

There is another related setting that is called – AspKeepSessionIDSecure. What this does is ensures that Session Id cookie travels only on the https traffic creating another problem of how to handle session id on non ssl pages.

So to secure your session id cookie you go to the global.asax and get into the session start event and simply mark or setup the session id cookie as secure. Here is how you do this -

Request.Cookies("ASP.NET_SessionId").Secure=True

This will mark the session id cookie to be secure.

Some handy resource links on this topic -

http://blogs.msdn.com/b/jaskis/archive/2009/12/23/securing-session-id-asp-asp-net.aspx

http://worldofasp.net/tut/SessionHijack/Securing_Session_In_ASPNET_793.aspx

http://msdn.microsoft.com/en-us/library/1d3t3c61.aspx

Comments

Post a Comment

Popular posts from this blog

Health Framework - Apple vs Android

In the past few years we have seen mobile and its apps rise and shine transforming many industries in its wake. However, the growth in health and fitness category has been less spectacular at 49% compared to overall mobile app industry which grew at 115% in the year 2013 (source Flurry Analytics). A few years ago Microsoft and Google attempted to make inroads into the health and fitness sector by bringing web based products to store and maintain health and fitness information like MS HealthVault and Google Health with not so spectacular results. Next came innovations by Fitbit in the wearables sector for activity tracking, in 2011 and 2012 they introduced first wireless activity trackers to sync using Bluetooth. This was followed by the entry of Jawbone into health sector with its announcements of Up wristband and accompanying app. These have had better success resulting in many startups joining the wearables product bandwagon.  Late to the stage almos...
Post a Comment
Read more

Notes on Castle MonoRail

  Sometime back I was doing a small POC on Castle MonoRail. So here are my quick notes on this. MonoRail is an MVC Framework from Castle inspired by ActionPack. MonoRail enforces separation of concerns with Controller handling application flow, models representing data and View taking care of the presentation logic. To work with MonoRail you need Castle Assemblies. It also utilizes nHibernate You can use Castle MonoRail Project Wizard or create the project manually. Project structure – Content Css Images Controllers HomeController.cs Models Views Home \ index.vm Layouts \ Default.vm ...
Post a Comment
Read more

Quick notes on Git

  I have been away from writing anything for a long time and instead have been fooling around with other stuffs like just plain reading, growing mustache, trying to learn swimming, trying to learn to play acoustic guitar and trying my hands at photography. To be honest I have not given up on them yet but neither have I been able to hang on to them in a disciplined manner. So here I am back to my writing after a long gap. This time its going to be quick notes on Git . Git is a file repository. As opposed to other repositories like SVN Git thinks of its data more like a snapshot of a mini filesystem. All operations in Git are local. (Entire history of the project is stored locally in your working directory) Browsing project history. Viewing all changes to a file. Git uses Checksum to track repository items Everything in Git is check-summed It uses SHA-1 hash for generating check sum values All a...
2 comments
Read more