ASP.NET MVC Application中如何处理ASP.NET_SessionId Cookie

Question

I have Asp.NET MVC application which gets logged in after secure Id and password authentication.

After login, when I go to developer tools in Web Browser and Copy the ASP.NET_SessionId Cookie and paste it in another browser without login with Id and password, It gets logged in.

Where this cookie is created? And how I can handle this vulnerability?

Answer 1

You are describing "session hijacking"

You should ensure that ASP.net requires https, and that cookies are not accessible to client side script, by adding this to web.config

<httpCookies httpOnlyCookies="true" requireSSL="true" />

You might also implement something like the SecureSessionModule in this article which generates some additional measures

Note the caveats

https://learn.microsoft.com/en-us/archive/msdn-magazine/2004/august/wicked-code-foiling-session-hijacking-attempts