是否有必要在 Web 应用程序中使用表单身份验证？

Question

We are developing an asp.net web app for trading in stock market. We need a high secure app. Is it safe not to use forms auth. Is it enough using ssl, httponly cookies, and preventing xss for a secure app?

What i know is;

In Forms authentication there are session and auth cookie. What is the difference to hack web app with forms auth. If a hacker able to steal session cookie. Its not so hard to steal auth cookie. How come is it safe to use forms authentication?(Is it just stealing one more cookie?)

Thanks.

Answer 1

In researching this myself -- this question seems about the crux of solution out of the box when using forms authentication in that it's not completely safe, but is if you can prevent stealing of the AUTH cookie.

While you can potentially add code to make it harder - it's a complex problem without a real unique point of difference per client that is currently easily replicated with the right tools and other attack vectors. It's also a user issue in how far you are willing to push them to prove who they are in a browser that was never designed for keeping state - which comes down to how much security measures you're willing to invent/invest in.

In learning the attack vectors, with Troy Hunts tuts , it is quite shocking how easy it can be having tried on few well know sites and how far behind I was regarding.

I guess the best advice if using forms authentication is to keep up to date with the current OWASP Top 10 issues and prevent as much as possible, or switch to something else.

fyi: while this post was old it was the first I found when looking for the same thing. I'm not a specialist in the field and others could give better answers to using something else more secure but, hoped this answer will help someone else with a similar question.