ASP.NET会话修复（ASP.NET_sessionid）

Question

Asp.net_SessionId is generated default by the system. Whenever this value copied from one browser to another user automatically access the pages inside login credentials.

case: First I logged in with my credentials in one browser (chrome). Now I open same browser in private mode (again chrome). Now I'll copy logged in browser session value to private mode and try to access the pages like dashboard, profile, settings etc. So here just by copying the session value I am able to access all the pages that require login.

How to prevent this? Please give me some suggestions.

I am able to prevent this in cross browser but I am not able to prevent it in same browser.

What I have tried:

I implemented the technique described here, but it's not working in my case. Yes its working with two different browser but not with single browser.

http://www.codeproject.com/Articles/859579/Hack-proof-your-asp-net-applications-from-Session

Please help me to solve this.

Answer 1

Whenever this value copied from one browser to another user automatically access the pages inside login credentials.

It depends on how you authenticate the user. If you just use Session State to keep track of user authentication like classic ASP days, it is true.

Nowadays, we use ASP.Net Identity or Form Authentication (Membership Provider) via SSL in which tokens are encrypted, and sign-out everywhere features. So it is not easily to hack Authentication Cookie in SSL (I do not say that impossible).

In ASP.Net MVC, we do not need to use Session State like we used to in ASP.Net Web Form and Classic ASP. Besides, using Session State directly becomes a bad practice in ASP.Net MVC.

The bottom line is if you use ASP.Net Identity or Form Authentication via SSL, I won't even worry about it. If you haven't use those, you definitely want to consider using it.