表单身份验证 - 需要 SSL - 设置身份验证 Cookie 失败

Question

I'm trying to configure my environment such that the authentication cookie can only be accessible through HTTPs (securing it from XSS attacks). I read several articles and I reached the conclusion that I should set the requireSSL attribute to "true"

<authentication mode="Forms">
  <forms name="someName" loginUrl="~/login" timeout="40" protection="All" slidingExpiration="true" defaultUrl="~/index" requireSSL="true" />
</authentication>

The problem is that when I'm trying to set the Authentication cookie, it throws an exception.

FormsAuthentication.SetAuthCookie(username, false);

Exception:

The application is configured to issue secure cookies. These cookies require the browser to issue the request over SSL (https protocol). However, the current request is not over SSL.

Stack trace:

System.Web.HttpException: The application is configured to issue secure cookies. These cookies require the browser to issue the request over SSL (https protocol). However, the current request is not over SSL.

at System.Web.Security.FormsAuthentication.SetAuthCookie(String userName, Boolean createPersistentCookie, String strCookiePath)

The problem occurs on my local machine (even though it's configured for HTTPs access) and on the live server as well (which is also on HTTPs)

Can anyone help me with this issue? Thanks.

Answer 1

This is a bit beside the point, but still relevant to what you're trying to accomplish. Your assumption that using the Secure flag on a cookie will protect it from XSS is incorrect. The secure flag simply means that the cookie will only be sent via HTTPS.

The flag you're actually looking for is the HttpOnly flag. The HttpOnly flag will cause the browser to only make the cookie available as a part of HTTP/S requests. The browser will then deny client side code (JavaScript, Flash, etc.) access to the cookie, thus protecting it against XSS.

All that being said, you should use both flags to protect sensitive cookies (like session cookies).

Answer 2

Deleting localhost certificates and recreating them by repairing IIS Express fixed this error in my case. I've followed the steps mentioned in this guide and that solved the issue on Visual Studio 2019.

Visual Studio 2017 - Resolving SSL/TLS Connections Problems with IIS Express

Select the Project -> F4

Select the Project Alt + Enter