Skip to main content

A few things on Session you should know

I got to read a good article explaining the nuances of cookie less sessions which prompted me to note down a few important things. Here is the link to post that started me on this.

To simply enable cookie less session do this -

<sessionState cookieless="true" />

What this will do is that your URL’s start looking like -

http://mysite.com/(22b5c4zyybphaw2mt3hjni2n)/Home.aspx

This is obviously not secure.

However what I want to note here is that even just having cookie based sessions (which is the default setting in .net web applications) is also not secure enough.

So did a bit of binging and found out fairly quickly that best thing to do is obviously setup the whole web site on an SSL. (pretty obvious that one).

However what if there are some pages that are outside the ssl. There is one confusing or very near and related setting in the forms element of the authentication tag that might fool someone which says setup forms element for authentication with requireSSL attribute as true. Now the problem with this is that it does not secure your Session Id cookie. Session Id cookie is generated on the very first hit and transmitted back to client even before your authentication kicks in.

There is another related setting that is called – AspKeepSessionIDSecure. What this does is ensures that Session Id cookie travels only on the https traffic creating another problem of how to handle session id on non ssl pages.

So to secure your session id cookie you go to the global.asax and get into the session start event and simply mark or setup the session id cookie as secure. Here is how you do this -

Request.Cookies("ASP.NET_SessionId").Secure=True

This will mark the session id cookie to be secure.

Some handy resource links on this topic -

http://blogs.msdn.com/b/jaskis/archive/2009/12/23/securing-session-id-asp-asp-net.aspx

http://worldofasp.net/tut/SessionHijack/Securing_Session_In_ASPNET_793.aspx

http://msdn.microsoft.com/en-us/library/1d3t3c61.aspx

Comments

Post a Comment

Popular posts from this blog

Notes on Castle MonoRail

  Sometime back I was doing a small POC on Castle MonoRail. So here are my quick notes on this. MonoRail is an MVC Framework from Castle inspired by ActionPack. MonoRail enforces separation of concerns with Controller handling application flow, models representing data and View taking care of the presentation logic. To work with MonoRail you need Castle Assemblies. It also utilizes nHibernate You can use Castle MonoRail Project Wizard or create the project manually. Project structure – Content Css Images Controllers HomeController.cs Models Views Home \ index.vm Layouts \ Default.vm ...
Post a Comment
Read more

URL Rewriting

When I first ventured into this topic I thought this would be pretty straight forward but then being in software field I should have known better. Nothing is as simple as it sounds. So here we go URL re-writing in ASP.Net. What URL re-writing means is that you intercept an incoming web request in your web application and then redirect the web request to a different web resource in your web application. Now this is not done simply using Response.Redirect or Server.Redirect. There are many reasons why you would choose to do URL re-writing and the major ones could be - You want your urls to be search engine friendly. Your website has undergone restructuring or you expect the folders to be moved arround later. You want your urls to be user friendly (as in easier to remember). Any web request when it enters the ASP.Net engine an HTTPContext object is created and assigned to it and then it goes through a series of HTTPModules finally hitting a HTTPHandler. The HTTPContext object provides a m...
Post a Comment
Read more

Workflow Foundation 4 - Part 3 - Data storage and management

This is my third post on WF4. First one was an introductory post on WF4 and in second one we focused on executing workflows. In the this post I am going to focus on the topic of data storage and management. Every business process or flow depends on data. When you think of data there are three elements to it as listed below - Variables - for storing data Arguments - for passing data Expressions - for manipulating data. Let us first look at the variables. Variables are storage locations for data. Variables are declared before using them just like in any other languages like C# or VB.Net. Variables are defined with a specific scope. When you create a variable in an activity the scope of the variable becomes that activity's scope. Variables can also have access modifiers like None, Mapped or ReadOnly. Let us look at an example where we will create two variables and assign a scope to them along with access modifiers. //Declare a sequence activitiy Sequence seqWf = new Sequence(); //de...
Post a Comment
Read more