经典ASP / IIS 6.0会话cookie长度

Question

IIS 6.0 uses the following format for session ID cookies

Set-Cookie: ASPSESSIONIDACTCRDDR=EMGFKIKAPMLMCAJPOAPNKADG;

where the part after ASPSESSIONID is random. The random part is not very long and valid session IDs can be guessed.

Is there a way to configure IIS 6 to make the cookie longer and thus more secure?

Do you know whether the format is the same for IIS 7 or higher?

Answer 1

What exactly are you expecting to read this information?

If you're that concerned over the security of information traveling "over the wire", then go SSL (including the login form).

If you're concerned about something locally reading the information, then you've got bigger problems - either something on his end is compromised, or someone injected some code into your site.

If you're concerned about random guessing, that's not a practical attack against this sort of information. Usually its just easier to listen for the info over the wire or hijack the data by some other means (eg man-in-the-middle).